Fix Ajax action to work with CSRF security.