Sorted out the JSON post problem

As is, the asp.net AntiForgery attribute only looks in the form so you
have to use form encoded data. This is not really what we want, we want
to be able to post json using the correct content type and still have
the anti forgery tokens work properly. Done using a custom http header
instead of a form value.