Add CSRF_COOKIE_HTTP_ONLY note to CSRF AJAX docs

[Andrew Charles]

​https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-httponly
​https://docs.djangoproject.com/en/dev/ref/csrf/#ajax

There should be a note in the CSRF AJAX docs that the CSRF_COOKIE_HTTP_ONLY setting will prevent non-safe ajax calls from working (if using the js provided). It should note that you have to include the csrf token via the template tag {% csrf_token %}, and update the js with something like this:

var csrftoken = getCookie('csrftoken');
if (csrftoken === null) {
    csrftoken = $('input[name="csrfmiddlewaretoken"]').val();
    if (csrftoken === null) {
        console.log('No csrf token');
    }
}

This is my first Django issue/ticket, sorry if I missed anything.