readme: clarify options, esp. regarding security.

See also: expressjs/csurf#12