fix, avoid ajaxSetup with single csrftoken.