Note csrf_token in readme