csrf docs added

Added small docs about csrf validation in controller. 
Also @qiangxue i think it would be better if this property also can be an array or we need ```$excludeCsrfValidate = []``` this array will hold actions that should be excluded from csrf validation of the current request. 
Can be helpful for example for upload action (usually it is standalone ```Upload < Action```), anyway currently there is no way to cansell csrf validation per some actions. Can submit PR if needed. Only small modifications here are needed: https://github.com/yiisoft/yii2/blob/master/framework/yii/web/Controller.php#L93