remove CSRFExemption for ajax calls