Documented how to do CSRF-protection by default in jQuery

Also, minor refactoring.