Add note about Ajax and CSRF-Token [ci skip]

`content='THE-TOKEN>'>` should be `content='THE-TOKEN'>`