Adding CR status text for webappsec.

Sometimes specs hit CR. Who knew?!