add note about enabling csrf validation