removed the mention of CSRF as this is not the case anymore as of 2.4+