mention replay-attack prevention in readme