Add note about security implications of displaying content from source

[barnabywalters]

Sounds like this was closed 3 months ago, feel free to reopen if anyone feels a5e6785 didn’t resolve it