Update html.md

Clarified that token is only automatically created when you use Form::open with POST, PUT or DELETE. It's not automatically created when you use GET.