externalized csrf javascript