added a note about csrf to the readme