Add note about CSRF and caching