readme change and set CSRF to FALSE