current status with ajax CSRF unresolved