added CSRF docs