[IMP] csrf: better warning and documentation
[IMP] csrf: better warning and documentation

After initial implementation CSRF protection had been left poorly
documented tripping up users and developers (#9538, #10139).

Add a warning in the logs for developers, and a more extensive
explanation of the whole thing in the @route docstring (and the official
documentation).

Fixes #10158

bplancher/odoo,laslabs/odoo,dfang/odoo,hip-odoo/odoo,storm-computers/odoo,microcom/odoo,bplancher/odoo,bplancher/odoo,hip-odoo/odoo,dfang/odoo,hip-odoo/odoo,sysadminmatmoz/OCB,laslabs/odoo,sysadminmatmoz/OCB,sysadminmatmoz/OCB,laslabs/odoo,Elico-Corp/odoo_OCB,hip-odoo/odoo,storm-computers/odoo,sysadminmatmoz/OCB,microcom/odoo,storm-computers/odoo,hip-odoo/odoo,dfang/odoo,Elico-Corp/odoo_OCB,sysadminmatmoz/OCB,dfang/odoo,storm-computers/odoo,stephen144/odoo,microcom/odoo,bplancher/odoo,storm-computers/odoo,stephen144/odoo,dfang/odoo,hip-odoo/odoo,sysadminmatmoz/OCB,stephen144/odoo,ygol/odoo,stephen144/odoo,ygol/odoo,ygol/odoo,ygol/odoo,Elico-Corp/odoo_OCB,microcom/odoo,dfang/odoo,Elico-Corp/odoo_OCB,microcom/odoo,laslabs/odoo,bplancher/odoo,stephen144/odoo,Elico-Corp/odoo_OCB,ygol/odoo,storm-computers/odoo,stephen144/odoo,Elico-Corp/odoo_OCB,laslabs/odoo,ygol/odoo,laslabs/odoo,bplancher/odoo,microcom/odoo,ygol/odoo,sysadminmatmoz/OCB