Fix CSRF Description

[ConnorNelson]

There are a number of issues here.

• "Site" and "Origin" are used a little loosely. They both have very specific definitions that are different.
• JavaScript not including cookies is because the default of fetch is to only include them for the same origin, but credentials="include" allows them to be sent (https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials). Probably we should link to that documentation somewhere.
• My understanding is that the Same Origin Policy really is less to do with sending requests and more to do with reading responses. For example, you can totally send a request, with cookies, using javascript. You just can't read the response (but the server still totally processed that request). Technically it's more complicated than that, only "simple" requests can be made. Cookie sending/not-sending is completely orthogonal (except that the default of the fetch API is to only include same-origin).

[ConnorNelson]

I'm also really not sure what was meant by "the cookie is only accessible in HTTP headers", so I removed it.