Update csrf.rst

Make sure to never send the CSRF token to other domains. crossDomain is in jQuery 1.5.1+
Merge pull request #139 from devin60070/patch-1

Update csrf.rst