Add documentation for CSRF and flash key configuration