fix the bug caused by not adding csrf when post ajax