Friends, CSRF, AJAX example, Restful Photos and other