Add CSRF note to url_for_oauth_code