updated readme with pow information
not do csrf yet