Better unicode security warning

Mention TR39, http://websec.github.io/unicode-security-guide/,
syntax spoofs and confusables at least, but there are also
normalization issues, manipulating combining-marks, and issues with
too permissive non-strict utf8 handling.