most work for ajax image select done, add csrf token