added csrf back

Added CSRF back to Cards Controller, had to get a session token in post
for AJAX to work with csrf filter.