add notes about csp into README
update changelog