Document XSRF protection

[tachyondecay]

This is a relatively new feature. I believe it was introduced in 2.4 and then made mandatory in 2.5—and so it has confused not a few people, myself included, since I only started developing with Symphony again recently, so I … um … skipped most of 2.5. :D

I think we should add an XSRF concept page, and then we should look out for pages that talk about form submission and amend them to mention passing the XSRF token.