Adding missing Anti-Xsrf token validations in some Post actions

1. Also adding this validation on a AJAX only used action.
This is an incorrect implementation of CSRF defenses and could leave the application vulnerable in certain circumstances.  I'll follow up offline with what a correct implementation should look like.