Add documentation about enabling CSRF validation