improved osc_csrf_check, added redirects if can be redirected and if ajax return json with error msg