* moved comment regarding csrf to 'production notes'
* fixed whitespace