Update Skinny Web to describe 6.2 CSRF details

Add extra origin to cover both types of access (using the plugin's context and not using the plugin's context).