add csrf-roken for ajax requests

ajax requests need csrf-roken