Use .prop() instead .attr().
Supports sending CSRF token via HTTP header.