CW L2 attack uses predictions instead of logits

Running the Carlini and Wagner attack, I was having less success than the paper stated. I noticed that the implementation in Foolbox was using the final normalised predictions instead of the unnormalised logits, which makes the attack less effective than it is supposed to be (especially against defensive distillation).

This might be the task of the person running the attack to pass a logits model, but it is still worth mentioning maybe in the documentation?