Token authentication header setup via ajax prefilter, no longer explicit in every ajax call