csrf.js wrapper for ajax POST