Adding CSRF attack and explanation