Adding comment on CSRF authentication.