allow same-origin-ajax-xsrf calls only