Document the Captcha CSP fix