added description of CSRF and instructions
minor css tweaks for fonts, header p