Production recommendation: include multiple node addresses in --join

[jseldess]

When adding a node to a cluster, you must specify the address of at least one existing node in the --join flag. We should update production deployment docs to recommend putting multiple node addresses in there, so the node can restart even if one of the nodes in join isn't available.

In local startup docs, probably ok to leave the code samples with one other address in join, but we could mention this in the supporting text.

Also, we should clarify that --join is not required on node restart. The only exception is if, when a node was started, it was shut down before it saved its peer address to disk.

@knz, @aphyr

[jseldess]

Closing in favor of #3395.