remove csrf check since it does not work reliably
fix language initialization for ajax requests
v0.4.8