modify the comment of CSRF check
update README.md