Add XSRF change to the release notes.
Set version number to 4.0b3.