csrf docs added

Added small docs about csrf validation in controller. 
Also @qiangxue i think it would be better if this property also can be an array or we need ```$excludeCsrfValidate = []``` this array will hold actions that should be excluded from csrf validation of the current request. 
Can be helpful for example for upload action (usually it is standalone ```Upload < Action```), anyway currently there is no way to cansell csrf validation per some actions. Can submit PR if needed.