verify ajax calls to have the correct csrf token