include the X-CSRF-Token header with every Ajax request