added: reference to struts csrf vuln in slide note.