add csrf meta tag to ajax request