Always send CSRF token with AJAX requests