Moved CSRF docs out of contrib.