Bug #2984: Add a csrftoken to the upload ajax call

(cherry picked from commit 09524280270cd160410bc035dac6eab6c932e884)