[docs] Make clear that sesskey is CSRF token.

[docs] Make clear that sesskey is CSRF token. #1499