Fixed documentation about Csrf being disabled by default.

Commit fa529c5ba1bc7dae6198a39a744aa096020f29d6 changed the way Csrf got enabled, from being enabled to default to disabled by default. The documentation didn't get updated, leading to confusion.