Add comment in JS code about CSRF config