Added CSRF to notes