update request_forgery_protection docs

I made some documentation changes in request_forgery_protection.rb:
1. Due to `protect_from_forgery` by default use `:null_session` method, some lines of documentation are obsolete.
2. Change controller name from `ApplicationController` to `ApiController`. `ApplicationController` can mislead developers, because usually rails application consist of non-api controllers and api controllers
It is better to keep ApplicationController. Even if the application consist on api an non-api it is still correct and doesn't need to explain what is a `ApiController` and how it would be used.