Add CSRF token to ajax request. Fixes: divio/django-cms#1906, ...

...and fixes divio/django-cms#1988