Boilerplate

Don't you think it's way beyond the scope of this application? I mean, with CSRF we won't be able to just visit the API in browser or hit it with Postman. I'd leave it like that and just say a few words about CSRF