Added CSRF protection for AJAX calls

See this document: http://flask-wtf.readthedocs.org/en/latest/csrf.html