Update security-interface.txt

Clarify: injected js must come from trusted sources.

Signed-off-by: Sam Kleinman <samk@10gen.com>