separated js from html and fixed JQuery csrf issue