be more specific about csrf token and ajax - not whitelisted outside of jquery-rails [ci-skip]

It's misleading to state that "Ajax calls" are whitelisted, when it's actually just requests that go via [jquery-rail's jQuery ajax prefilter](https://github.com/rails/jquery-rails/blob/8b1a118720ac5cab5691f75f67301d2915b01e4e/vendor/assets/javascripts/jquery_ujs.js#L324).