List security concerns

With React's [Pit of Success](https://facebook.github.io/react/blog/2014/03/28/the-road-to-1.0.html) in mind, we should list all the possible areas that need security considerations, and then think about convenient, secure-by-default ways of configuring access.
