CSRF developer guide: full write-up - lifecycle, code, new pages/modules, exemptions, testing, troubleshooting (HOLD for v3.0.0)
CSRF protection (S4) developer guide; S4 marked closed in 3.0.0 - HOLD: push when v3.0.0 is tagged