Rename csrf-protection -> csrf-protection.md