Add anti-forgery metas usage to README.
Merge branch 'token-via-header-plus' into token-via-header-deployable