csrf token with non-get ajax requests
release file updated