More CSRF doc updates