Use the private file system by default. Document how to configure settings.php.

config/install/system.file.yml

@@ -0,0 +1,3 @@
+allow_insecure_uploads: false
+default_scheme: private
+temporary_maximum_age: 21600

docs/development/index.md

@@ -28,3 +28,12 @@ database credentials:
 ## 3. Develop
 
 Open the `www` directory in your favorite IDE.
+
+## Optional
+
+### Configure private filesystem
+
+In order to upload files, the following line must be added to
+`www/web/sites/default/settings.php`:
+
+    $settings['file_private_path'] = 'sites/default/private/files';