Clarifying where the CSRF token can be found.