Edited security token validation message to provide more information.

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ---
| Fixed tickets | #995
| License       | MIT
| Doc PR        | ---

@drak I removed the "should we expire the session also" comment. It is really easy to produce such a csrf error (when working with "Open in new Tab" functionality and Extensions module) and I don't think a user should be logged out.