Add note on auto CSRF handling.