now can collect & discollect resources by ajax
on each XMLHttpRequest, set a custom X-CSRFToken header to the value of the CSRF token, see https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax