Add note about Rails CSRF protections
Add note about Rails CSRF protections

It would be tremendously helpful if the documentation included a reference to Doorkeeper providing CSRF protection by default. I just spent 30 minutes trying to debug why my client was failing with CSRF protections even though my app was configured not to use it; hopefully this will help others as well.

(In the end, I wasn't able to use `api_only`, as the JSON response isn't what I was expecting or wanting; I had to monkey-patch the controller. Would you be open to a pull request that added an option to control CSRF protection separately from `api_only`?)
mavenlink/doorkeeper,doorkeeper-gem/doorkeeper,doorkeeper-gem/doorkeeper,mavenlink/doorkeeper,jasl/doorkeeper,outstand/doorkeeper,doorkeeper-gem/doorkeeper,outstand/doorkeeper,jasl/doorkeeper,jasl/doorkeeper,mavenlink/doorkeeper,outstand/doorkeeper