Add TODO to README about searching for AR columns from db/schema
Add whitelisting - needs specs, etc