Update csrf.rst

Make sure to never send the CSRF token to other domains. crossDomain is in jQuery 1.5.1+