[FIXED JENKINS-15252] Explain problems with CSRF protection

As PR to invite review of the explanation: Suggestions for improvement welcome!
That's probably the one. I used something kohsuke wrote in IRC + the last sentence above the list for this without a specific issue in mind.