[FIXED JENKINS-15252] Explain problems with CSRF protection

As PR to invite review of the explanation: Suggestions for improvement welcome!
Basically, yes. Given the age, documenting this seemed useful. Can always be removed once obsolete.