backbone synk and csrf_hack for manual ajax requests