[FIXED JENKINS-15252] Explain problems with CSRF protection

As PR to invite review of the explanation: Suggestions for improvement welcome!
[JENKINS-12875](https://issues.jenkins-ci.org/browse/JENKINS-12875)?