Made the CSRF documentation more clear

As mentioned in the issue, this changes the wording so that it is clear that the CSRF token is required in order to make requests.

This closes #984.