add: config: new flask-wtf csrf option
add: note about config priority in README