Update link to JSON list CSRF vulnerability