fix README of CSRF