Add X-CSRF-Token to ajax request