Use passive ajax token declared in a meta tag.
Updated configuration