found a better way to set the XSRF thingy

Using the gem 'angular_rails_csrf' instead of cluttering the
application controller.
listener for 401s application-wide

Added a listener on the $rootScope for the devise:unautorized event,
all it does is redirect to '/'. Might be too abrupt but works for
the time being. I also decided to fix some convention naming for
js/ruby.
Merge pull request #33 from rcsole/private

Private API