Add evil.post and CSRF token to AJAX requests