added a form to create a post also added some logic to the application controller to allow the js client to pass a CSRF token with each non GET request