Include CSRF note in SessionAuthentication docs.