Correctly set csrf token for ajax requests