Set null: false explicitly in timestamps
Fix docs for http_authenticatable_on_xhr, closes #3112