added csrf javascript