core: prefetch the CSRF token rather than hardcodng it in the JS file.