Security update

Bumps Bleach from v2 to v3.1.1 as per #7

Also includes some new info on how to get hot-reloading working with react-scripts@>=3.4.