added csrf to ajax calls
son whitespace conflicts are so 1765