update request_forgery_protection docs

I made some documentation changes in request_forgery_protection.rb:
1. Due to `protect_from_forgery` by default use `:null_session` method, some lines of documentation are obsolete.
2. Change controller name from `ApplicationController` to `ApiController`. `ApplicationController` can mislead developers, because usually rails application consist of non-api controllers and api controllers
:null_session was discussed in #5326. Quote from there:
> null_session is another change we'd discussed, instead of resetting the session it should just assign the cookie and session objects to values which return null for everything and then send no Set-Cookie headers in the response.

Look at method [`handle_unverified_request `](https://github.com/rails/rails/blob/master/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L124)

In case you call `skip_before_action :verify_authenticity_token`, `handle_unverified_request` method of `NullSession` class wouldn't be called. It's mean that session variable will be real session and all data populated to session will be stored for subsequent requests. That's means that api will be vulnerable for CSRF attacks.

But if you delete `skip_before_action :verify_authenticity_token` line. `session` will be NullSessionHash and all data populated to session will be lost for subsequent requests