remote to use .post instead of .get

added the option so specify a data-token to prevent csrf