report dismissal and some basic ajax stuff
don't show csrf token on static pages