Update readme with CSRF information