modify README.md

remove "sql injection guard" from todo