fix readme to mention csrf cookie