Add caveat to readme on security of external js