Fixes #165

spec/vulnerabilities/csrf_spec.rb

@@ -7,7 +7,7 @@ feature 'csrf' do
     @normal_user = UserFixture.normal_user
   end
 
-  scenario 'attack', :js => true do
+  scenario "attack\nTutorial: https://github.com/OWASP/railsgoat/wiki/R4-A8-CSRF", :js => true do
     visit '/'
     # TODO: is there a way to get this without visiting root first?
     base_url = current_url