SEC-2282: Polish CSRF Documentation

Explain why (passivity) XML Namespace doesn't enable csrf protection by
default.
SEC-2285: Polish Security Headers Documentation

Explain why (passivity) XML Namespace doesn't enable security headers by
default.
SEC-2331: Include Expires: 0 in security headers documentation