Add note about XSS vulnerabilities to README