Add socket.io threat model explanation to README