Update CSRF protection docs
Fix docs typo