Working ajax login, working csrf protected endpoints