New model pull request for code review

should be able to add csrf tokens to javascript ajax calls so you don't need to make this exempt