csrf updates to work w/Ajax post