Minor proofreading changes

Author: MarkvanMents

content/en/docs/howto/security/best-practices-security.md

@@ -139,7 +139,7 @@ This authentication option is not available for Published Web Services and can o
 
 If you choose this option, the API will expect a "X-Csrf-Token" HTTP request header to be set on each incoming request. This authentication option is particularly interesting for custom JavaScript and widget implementations.
 
-The session token can be acquired by calling Mendix Client API method to get the current CSRF token. This method should be called before each API call in your widget or JavaScript action to prevent cross-site request forgery (CSRF/XSRF).
+The session token can be acquired by calling a Mendix Client API method to get the current CSRF token. This method should be called before each API call in your widget or JavaScript action to prevent cross-site request forgery (CSRF/XSRF).
 
 ```javascript
 import getCSRFToken from "mx-api/session";

content/en/docs/howto10/security/best-practices-security.md

@@ -141,9 +141,9 @@ If you choose this option, the API will expect a "X-Csrf-Token" HTTP request hea
 
 The session token can be acquired by calling Mendix Client API method to get the current CSRF token. This method should be called before each API call in your widget or JavaScript action to prevent cross-site request forgery (CSRF/XSRF).
 
-For Mendix versions below 10.23 you can call `mx.session.getConfig("csrftoken")` in your widget or JavaScript action.
+In Mendix versions below 10.23 you can call `mx.session.getConfig("csrftoken")` in your widget or JavaScript action.
 
-For Mendix versions 10.23 and higher:
+In Mendix versions 10.23 and above:
 
 ```javascript
 import getCSRFToken from "mx-api/session";