fix documentation for csrf checking