Add note about Ajax and CSRF-Token [ci skip]