Merge pull request #4250 from daniel-beck/crumb-exclusion-javadoc

Note that CSRF crumbs aren't really needed anymore for API clients

core/src/main/java/hudson/security/csrf/CrumbExclusion.java

@@ -17,6 +17,10 @@ import java.io.IOException;
 /**
  * Allows plugins to define exceptions to the CSRF protection filter.
  *
+ * Please note that Jenkins 2.96 and newer accepts HTTP POST requests without CSRF crumb, if
+ * HTTP Basic authentication uses an API token instead of a password, so many use cases
+ * (simple API clients that support authentication but not obtaining a crumb) should be obsolete.
+ *
  * @author Kohsuke Kawaguchi
  * @since 1.446
  */