Fixing csrf in ajax view of first site view (no cookie yet)