add note about the Session component needed for CSRF check