added authenticity token for all ajax requests else Rails will crib