Mention new CSRF protection gotcha in upgrade guide