Add a missing word in CSRF docs.