update request_forgery_protection docs

I made some documentation changes in request_forgery_protection.rb:
1. Due to `protect_from_forgery` by default use `:null_session` method, some lines of documentation are obsolete.
2. Change controller name from `ApplicationController` to `ApiController`. `ApplicationController` can mislead developers, because usually rails application consist of non-api controllers and api controllers
It's wrong. 
From documentation of `:null_session`: 
:null_session - Provides an empty session during request but doesn't reset it completely

That's right:
```ruby
# CSRF protection is turned on with the <tt>protect_from_forgery</tt> method.
# By default <tt>protect_from_forgery</tt> protects your session with :null_session
# method, which provides an empty session during every request
```