Add info about CSRF protection and filename sanitation