added note to the readme about --disable-web-security