Update Skinny Web to describe 6.2 CSRF changes

Slightly reworded the section on CSRF to denote that skinny-web does not require the use of p_auth in 6.2 since it is built with anonymous access @AccessControlled(guestAccessEnabled=true). 

Because skinny-web in 6.2 does not require dealing with CSRF, I tried to re-word it to show more generic examples for 6.2 whitelisting, and specifically saying that skinny-web does not need it. If you think it's weird to talk about CSRF and in skinny-web area even though it's not needed in 6.2, you could possibly move it to a more generic section to talk about CSRF.