add a note about skipping omniauth CSRF