Add note about Ajax and CSRF-Token [ci skip]

@rafaelfranca Done.