title: Cross Site Request Forgery protection in Django - a better explanation?
body: <p>I've just completed part 4 of the Django 1.4 tutorial and I'm sure they just chucked CSRF and generic views in to confuse the hell out of me.</p>
  
  <p>Okay, so generic views I get now, but I don't understand what is happening with CSRF protection.</p>
  
  <p>This is what I think is happening: the CSRF token is a hash/key generated by modules used in the app and a logged in user if logged in. The token is somehow sent with a POST method form to the receiving view which again generates the hash and compares it with the one sent with the form to make sure nobody has snooped in? Have I got this completely wrong?</p>
  
  <p>Having used the rest of the Django manual during the tutorial this is by far the most confusing manual page I have read. </p>