Removed CSRF token injection for AJAX request