Update README for CSRF notes

Merge request reports