Adding AntiForgery token to Setup and Template controllers

all AJAX calls should use the antiforgery token