add note about csrf protection