add README for CSRF sample app