update request_forgery_protection docs

I made some documentation changes in request_forgery_protection.rb:
1. Due to `protect_from_forgery` by default use `:null_session` method, some lines of documentation are obsolete.
2. Change controller name from `ApplicationController` to `ApiController`. `ApplicationController` can mislead developers, because usually rails application consist of non-api controllers and api controllers
1. Because `protect_from_forgery` do nothing without `verify_authenticity_token` call. 
2. :null_session replaces `skip_before_action :verify_authenticity_token`