Update CSRF docs to better explain API usage scenarios

- CSRF protection does not only apply to HTML/JS requests anymore (as
  far as I can tell)
- CSRF protection is still fine to use with API requests and Rails
  supports this scenario through the X-CSRF-Token header. Updated the
  docs to reflect and explain this.