Update README.rdoc

Add a note about securing ActiveRecord resources by default, as an alternative to having to make sure each model is protected.