Address issue #152 (stupidity prevention in CSRF docs)

See issue #152

Add a chunk to the documentation on CSRF protection to help stupid users like me avoid a stupid mistake