Added note about XSRF.