add csrf instructions to README