enforce token on ajax calls