Add XSRF change to the release notes.

docs/releases/next.rst

@@ -269,6 +269,11 @@ Other notes
 * `.StaticFileHandler` now streams response bodies to the client.
 * New setting ``compress_response`` replaces the existing ``gzip``
   setting; both names are accepted.
+* XSRF cookies that were not generated by this module (i.e. strings without
+  any particular formatting) are once again accepted (as long as the
+  cookie and body/header match).  This pattern was common for
+  testing and non-browser clients but was broken by the changes in
+  Tornado 3.2.2.
 
 `tornado.websocket`
 ~~~~~~~~~~~~~~~~~~~