Node: Add new Advanced Topics lesson - #31398

One thing I think makes this section incomplete is that it's not quite clear exactly where the learner stands in relation to all this.
e.g. from this section, I can absolutely see a learner going "how would I use a CSRF token here? I don't have anything to do with cutekittens.com nor my-bank.example.org!"
The example used here makes sense but it's the bank site's responsibility to implement anti-CSRF measures, not the user's responsibility.

This section needs to clearly frame things so that it's relevant to the learner and them building sites/servers. The problem is specifically that if they're building something, not using anti-CSRF techniques like CSRF tokens is what can allow a malicious site to make a malicious request. By using something like CSRF tokens, a malicious site can certainly try a CSRF attack on your site but since they won't have the correct token, the request will not succeed.

So this example can be kept but instead of saying "So what could you do about it?" (which makes it sound like the user is the one to protect the banking site), frame it as what the banking site could do to protect against CSRF.
Then expand by framing things for when the learner is making their own sites, and how they can use stuff like CSRF tokens to protect users of their sites from CSRF.

A separate thing I want to also point out about this section is that it probably won't be clear to learners exactly where the bank site URL comes from. The point is that whoever made the malicious site knows the URL (and params) that could get them what they want, and that's why they crafted the request URL in that way (see https://stackoverflow.com/a/33829607 for more context). It's not just any ol' URL/request to some random site.

1. "documentation" is an uncountable noun (i.e. no plural)
2. Rephrasing for better flow from the previous line. Starting straight with "MDN also accommodates..." reads to me a little like it's out of nowhere.

What do you think about something like this:

I think it's a good idea to make it clear that internationalisation is something that has to be manually implemented and not some automatic translation that can be done for any site by just adding headers. While the current text kinda hints at that, actually linking MDN's translated-content repo should make it much clearer that it's a pretty damn big job that has to be manually worked on (they only provide content for certain languages too, not just automatic translation for anything).

Also providing more than one language example feels nicer IMO (but that's just a nit; also using our style guide's aria-label/title links syntax for visually nicer links while still remaining sufficiently accessible.