Service controller updated: check for ajax, check csrf token.