Make vendor URL configurable, add docs, add CSRF token