Clarify configuration options for CsrfProtectionMiddleware

Refs #12294

src/Http/Middleware/CsrfProtectionMiddleware.php

@@ -40,11 +40,12 @@ class CsrfProtectionMiddleware
     /**
      * Default config for the CSRF handling.
      *
-     *  - `cookieName` = The name of the cookie to send.
-     *  - `expiry` = How long the CSRF token should last. Defaults to browser session.
-     *  - `secure` = Whether or not the cookie will be set with the Secure flag. Defaults to false.
-     *  - `httpOnly` = Whether or not the cookie will be set with the HttpOnly flag. Defaults to false.
-     *  - `field` = The form field to check. Changing this will also require configuring
+     *  - `cookieName` The name of the cookie to send.
+     *  - `expiry` A strotime compatible value of how long the CSRF token should last.
+     *    Defaults to browser session.
+     *  - `secure` Whether or not the cookie will be set with the Secure flag. Defaults to false.
+     *  - `httpOnly` Whether or not the cookie will be set with the HttpOnly flag. Defaults to false.
+     *  - `field` The form field to check. Changing this will also require configuring
      *    FormHelper.
      *
      * @var array