Update PANDA.md

Update docs to point to usage of before/after user syscalls, and point out that if they work, they probably wont for long.