[#3327] Minor tweaks to Login form CSRF entry

Author: weaverryan

cookbook/security/csrf_in_login_form.rst

@@ -8,10 +8,15 @@ When using a login form, you should make sure that you are protected against CSR
 (`Cross-site request forgery`_). The Security component already has built-in support
 for CSRF. In this article you'll learn how you can use it in your login form.
 
+.. note::
+
+    Login CSRF attacks are a bit less well-known. See `Forging Login Requests`_
+    if you're curious about more details.
+
 Configuring CSRF
 ----------------
 
-At first, you have to configure the Security component so it can use CSRF protection.
+First, configure the Security component so it can use CSRF protection.
 The Security component needs a CSRF provider. You can set this to use the default
 provider available in the Form component:
 
@@ -61,17 +66,18 @@ provider available in the Form component:
             )
         ));
 
-The Security component can be configured further, but this is all information it needs
-to be able to use CSRF in the login form.
+The Security component can be configured further, but this is all information
+it needs to be able to use CSRF in the login form.
 
 Rendering the CSRF field
 ------------------------
 
-Now the Security component checks for CSRF tokens, you have to add a *hidden* field
-to the login form containing the CSRF token. By default, this field is named as
-``_csrf_token``. That hidden field has to contain the CSRF token, which can be generated
-by using the ``csrf_token`` function. That function requires a token ID, which must
-be set to ``authenticate`` when using the login form:
+Now that Security component will check for the CSRF token, you have to add
+a *hidden* field to the login form containing the CSRF token. By default,
+this field is named ``_csrf_token``. That hidden field must contain the CSRF
+token, which can be generated by using the ``csrf_token`` function. That
+function requires a token ID, which must be set to ``authenticate`` when
+using the login form:
 
 .. configuration-block::
 
@@ -162,3 +168,4 @@ After this, you have protected your login form against CSRF attacks.
             ));
 
 .. _`Cross-site request forgery`: http://en.wikipedia.org/wiki/Cross-site_request_forgery
+.. _`Forging Login Requests`: http://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests