add csrf stuff and description on how to make post requests
inc version