Still working on the draft.  In the meantime, found one more place documenting this issue (leaving it here so we remember to revise it later):

The help text for 'show_multiple_locations' in the sample config file says:

# DEPRECATED:
# Show all image locations when returning an image.
#
# This configuration option indicates whether to show all the image
# locations when returning image details to the user. When multiple
# image locations exist for an image, the locations are ordered based
# on the location strategy indicated by the configuration opt
# ``location_strategy``. The image locations are shown under the
# image property ``locations``.
#
# NOTES:
#     * Revealing image locations can present a GRAVE SECURITY RISK as
#       image locations can sometimes include credentials. Hence, this
#       is set to ``False`` by default. Set this to ``True`` with
#       EXTREME CAUTION and ONLY IF you know what you are doing!
#     * See https://wiki.openstack.org/wiki/OSSN/OSSN-0065 for more
#       information.
#     * If an operator wishes to avoid showing any image location(s)
#       to the user, then both this option and
#       ``show_image_direct_url`` MUST be set to ``False``.
#
# Possible values:
#     * True
#     * False
#
# Related options:
#     * show_image_direct_url
#     * location_strategy
#
#  (boolean value)
# This option is deprecated for removal since Newton.
# Its value may be silently ignored in the future.
# Reason: Use of this option, deprecated since Newton, is a security risk and
# will be removed once we figure out a way to satisfy those use cases that
# currently require it.  An earlier announcement that the same functionality can
# be achieved with greater granularity by using policies is incorrect.  You
# cannot work around this option via policy configuration at the present time,
# though that is the direction we believe the fix will take.  Please keep an eye
# on the Glance release notes to stay up to date on progress in addressing this
# issue.
#show_multiple_locations = false

Also, here's the text for 'show_image_direct_url':

#
# Show direct image location when returning an image.
#
# This configuration option indicates whether to show the direct image
# location when returning image details to the user. The direct image
# location is where the image data is stored in backend storage. This
# image location is shown under the image property ``direct_url``.
#
# When multiple image locations exist for an image, the best location
# is displayed based on the location strategy indicated by the
# configuration option ``location_strategy``.
#
# NOTES:
#     * Revealing image locations can present a GRAVE SECURITY RISK as
#       image locations can sometimes include credentials. Hence, this
#       is set to ``False`` by default. Set this to ``True`` with
#       EXTREME CAUTION and ONLY IF you know what you are doing!
#     * If an operator wishes to avoid showing any image location(s)
#       to the user, then both this option and
#       ``show_multiple_locations`` MUST be set to ``False``.
#
# Possible values:
#     * True
#     * False
#
# Related options:
#     * show_multiple_locations
#     * location_strategy
#
#  (boolean value)
#show_image_direct_url = false