finished CSRF/AJAX, closes issue #21