Update README.md (facebook#3717)

* Update README.md with a note that reminds users to prepend REACT_APP_ to their environment variables. 
* Based on facebook#865, where Dan Abramov suggests the person who filed the issue create a PR with these changes.
* Took the language from [Adding Custom Environment Variables](https://github.com/facebookincubator/create-react-app/tree/master/packages/react-scripts/template#adding-custom-environment-variables)

template/README.md

@@ -944,6 +944,7 @@ To define permanent environment variables, create a file called `.env` in the ro
 ```
 REACT_APP_SECRET_CODE=abcdef
 ```
+>Note: You must create custom environment variables beginning with `REACT_APP_`. Any other variables except `NODE_ENV` will be ignored to avoid [accidentally exposing a private key on the machine that could have the same name](https://github.com/facebookincubator/create-react-app/issues/865#issuecomment-252199527). Changing any environment variables will require you to restart the development server if it is running.
 
 `.env` files **should be** checked into source control (with the exclusion of `.env*.local`).