The first comment does not explain anything that the code doesnt and the...

The first comment does not explain anything that the code doesnt and the second is now irrelevant with the dedicated API mode

railties/lib/rails/generators/rails/app/templates/app/controllers/application_controller.rb.tt

 class ApplicationController < ActionController::<%= options[:api] ? "API" : "Base" %>
 <%- unless options[:api] -%>
-  # Prevent CSRF attacks by raising an exception.
-  # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 <%- end -%>
 end