1.2.0
readme: clarify options, esp. regarding security.

See also: expressjs/csurf#12
docs: fix secure documentation

closes #43