Add note about javascript calling security.