readme - adding credits
checking for csrf token (in the session) during remote requests