diff --git a/README.rst b/README.rst
index 5203f46..b93bd02 100644
--- a/README.rst
+++ b/README.rst
@@ -145,14 +145,14 @@ Requirements
 * `request.el`_ >= 0.2
 * `deferred.el`_
 * `skewer-mode.el`_
+* `auto-complete.el`_
+  You need to configure subpackage ``ein-ac`` to enable
+  this feature.
 * (optional) markdown-mode
 * (optional) python-mode:
   It should work with either python.el or python-mode.el.
   Fabian Gallina's `python.el`_ is required to use
   ``ein:console-open`` command.
-* (optional) `auto-complete.el`_
-  You need to configure subpackage ``ein-ac`` to enable
-  this feature.
 * (optional) `smartrep.el`_:
   This package enables you to omit typing prefix keys (e.g.,
   ``C-c C-n C-n C-n ...`` instead of ``C-c C-n C-c C-n C-c C-n ...``).
diff --git a/lisp/ein-pkg.el b/lisp/ein-pkg.el
index 572a632..4ce023a 100644
--- a/lisp/ein-pkg.el
+++ b/lisp/ein-pkg.el
@@ -2,6 +2,7 @@
   "0.13.0"
   "Emacs IPython Notebook"
   '((websocket "1.7")
+    (auto-complete "1.4.0")
     (request "0.3")
     (deferred "0.5")
     (cl-generic "0.3")
diff --git a/lisp/ein-query.el b/lisp/ein-query.el
index 389ac2d..0fdd704 100644
--- a/lisp/ein-query.el
+++ b/lisp/ein-query.el
@@ -74,6 +74,8 @@ will be canceled \(see also `ein:query-singleton-ajax').
 (defvar ein:query-running-process-table (make-hash-table :test 'equal))
 
 (defun ein:query-prepare-header (url settings &optional securep)
+  "Ensure that REST calls to the jupyter server have the correct
+_xsrf argument."
   (let ((cookies (request-cookie-alist (url-host (url-generic-parse-url url))
                                        "/" securep)))
     (ein:aif (assoc-string "_xsrf" cookies)