add csrf token for protection via ajax