Factored out CSRF JS code.