Fixed #23602 -- Add comment on get_absolute_url regarding user input

https://code.djangoproject.com/ticket/23602
Perhaps the attack could be described a bit more or a link added?