improved osc_csrf_check for ajax request