moved ajax CSRF token