fixed dealer waitlist/reject buttons on the group admin form

This was the cause of the bug; we switched to requiring a CSRF check for all ``@ajax`` methods, so we need to pass the token along with our other parameters.