CSRF protection and <script> tags

[designgrill]

Rails guide and documentation here and here mentions that cross-site (or remote) <script> tags are blocked to get a javascript response. I think the messaging can be made better.

• The blocking happens only for JS responses generated by a controller and doesn't apply to static files
• The blocking happens irrespective of whether the request was a remote <script> or made through the same domain. Any JS response generated by a controller for a non XHR request, by default, even from the same origin, will get blocked.

[rafaelfranca]

Could you please open a PR?

[designgrill]

@rafaelfranca Sure. Will do that soon.

Raised it as an issue to check if I am missing something. A rails rookie here.

[rafaelfranca]

I think you are correct but with a PR we can have a better idea on how you think the text could be improved and give better feedback.