xsrf added to js