Add note about CSP + CSRF

Closes #57.