CS sets CSFR on ajax requests