Fix csrf-ajax link

Fix as per #2045.