Q. Can you tell me what a RESTful API is and isn't?
A. Technically it means that the server holds no state. All state comes from the client. All API endpoints each serve a single purpose.
Q. What is CSRF and how does Rails protect against it?
A. Cross Site Request Forgery is when one website tries tells your browser to make a rquest to another website. Rails prevents this by embedding a secret token on its page that you have to give it back when you make a request. Other websites won't have that token.