title: What is the difference between null_session and reset_session in Rails 4?
body: <p>I'm currently working on a Rails application with a few other developers, and there are POSTs being made to the server via AJAX through Angular.  On occasion, we've noticed a few <code>InvalidAuthenticityToken</code> exceptions come through our email logs, which has led to us wanting to take action.</p>
  
  <p>Since this request is coming through Angular, my belief is that we are treating the server as an API, and we should be using <code>protect_from_forgery with: :null_session</code>.  However, <code>protect_from_forgery with: :reset_session</code> seems to provide us with the same resolution.</p>
  
  <p>I don't wish to blindly plug code in just because it's recommended, so I'd like to know the difference between these two forgery protection approaches.  When would I use one over the other, and why would I prefer its usage?</p>