Document why we don't set httponly on csrf_token

Closes #3030.