Adding missing Anti-Xsrf token validations in some Post actions

1. Also adding this validation on a AJAX only used action.
@GrabYourPitchforks what are your thoughts on this? If it's an AJAX-only scenario does it need anti-forgery protection?