remove csrf from todo list in readme.