there are a variety of reasons why authenticity tokens can be messed up for xhr/ajax, if you can't figure out why I can investigate