docs(security): add security doc

WIP
it's ok to mix server-side templating in the bootstrap template (index.html) as long as user input cannot be used on the server to output html that would then be processed by Angular in a way that would cause allow for arbitrary code execution.

in other words, use it to dynamically generate css, urls, etc, but don't generate templates for angular.