added readme note for localhost-only via spring-security-core

given the new layout and features make the potential for positive as well as negative use of this plugin even more obvious, i thought this little note wont harm.