config/application: secures AJAX requests against CSRF

* config.action_view.embed_authenticity_token_in_remote_forms = true