Improve CSRF documentation