Update security docs re: unreliability of Host headers (see #5)
Use a XSS-style token in params to fix #5; see docs/.../security.rst
Bump version