Fix csrf issue on ajax posts