add js for ajax csrf