Update csrf_safe? to check the headers. Add some JS code to insert the CSRF token into the XHR request headers.