Use passive ajax token declared in a meta tag.