+ ajax: add Django CSRF token
* models.py: ignore illegal img in album when save