Wording changes

Making a suggested change to my earlier commit.

Author: Jay Bryant

docs/manual/src/docs/asciidoc/_includes/about/exploits/csrf.adoc

@@ -349,7 +349,7 @@ One might ask why the expected CSRF token isn't stored in a cookie by default.
 This is because there are known exploits in which headers (for example, to specify the cookies) can be set by another domain.
 This is the same reason Ruby on Rails https://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/[no longer skips CSRF checks when the header X-Requested-With is present].
 See http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html[this webappsec.org thread] for details on how to perform the exploit.
-Another disadvantage is that by removing the state (that is, the timeout), you lose the ability to forcibly end the token if it is compromised.
+Another disadvantage is that by removing the state (that is, the timeout), you lose the ability to forcibly invalidate the token if it is compromised.
 
 // FIXME: Document timeout with lengthy form expire. We do not want to automatically replay that request because it can lead to exploit