add notes about config.py and security to the README.