added csrf token to xhr before dropzone sends file