update README with note about overriding defaults

README.md

@@ -75,6 +75,10 @@ options = {
 }
 ```
 
+NOTE: Changing the default behavior is done at your own risk, and almost certainly will make your
+application less secure.  Doing so should only be done with a very clear understanding of what you
+are doing.
+
 You can skip individual checks by passing an `options` dictionary with certain keys set to `False`.
 For example, if you want to verify the signature of a JWT that has already expired.