use token in ajax queries