Improved README / Made app a bit more generic

* We no longer assume that the position items are inside of p-tags
* Added some csrf decorators to the ajax view because without them I always
  got a 403 error when dragging things around.