Minor amend to readme security note

Add a reminder that security is still completely password dependant.