update request_forgery_protection docs