Require X-Requested-By header to prevent 3rd party javascript from
forging requests.
Clean up unintended file addition. Ignore this file in the future as it
is generated by a tool that we use.
Update docs to specify that X-Requested-By is a required header.
Merge pull request #195 from reciprocity/feature/eager-load-include

Requests require the custom header X-Requested-By to prevent a type of CSRF