More CSRF doc updates

Sorry missed this.

Luckily I'm have problems with this (lucky for you at least) and have reread this documentation over and over.