Add cross-site forgery protection for AJAX calls