Update 2015-03-17-security.md

minor change

Author: decebals

_posts/2015-03-17-security.md

@@ -88,7 +88,7 @@ The authentication tests to see if the 'username' attribute is present in the se
 than call the regular route with `routeContext.next()` else redirect to the login page.  
 I added `originalDestination` attribute because after authentication process I want to continue with the original destination (original url).
 
-### Cross-Site Request Forgery (CSRF) Protection
+#### Cross-Site Request Forgery (CSRF) Protection
 
 Pippo includes a simple CSRF handler which will automatically generate a CSRF token on GET requests, if there is no token in the current session, and verify that POST requests include the session's CSRF token.