Add security note to the user.getFormAuthToken() method