[FIXED JENKINS-15252] Explain problems with CSRF protection

As PR to invite review of the explanation: Suggestions for improvement welcome!