HOWTO use the app

TODO: execute CSRF attack