Security policy should probably not be listing an e-mail address

[bdach]

I tried using the one listed (secure@microsoft.com) today and got this back:

Now apparently the email still works if you use a magic token from here:

but it's probably easier for everyone involved if you just send people at this page first and then they can decide for themselves whether or not they wanna try the magic token or not...?

Same thing applies to README.md too.

[martincostello]

/cc @blowdart