Only allow certificates to built from a currently valid session.

rhy-jot, on freenode, pointed out that the previous version would allow
anyone to get a certificate signed for any email address.
Make sure we don't include script from a random host.

rhy-jot, on freenode, pointed out that this allows an attacker to run any
script in the context of the IdP, which is a really bad idea.
Update changelog for 0.3 release.
Add security disclaimer to README.