be more specific about csrf token and ajax - not whitelisted outside of jquery-rails [ci-skip]