Add a note about JavaScript injections to README