add session
add SessionMixin
add csrf
add auth
use SessionMixin
init csrf
replace superagent with $.ajax