updates to fix old bug with csrf token tracking, the lack of which
caused a 403 error during the ajax call for moves