Fixed ajax and csrf