Moving the location of the profile div moved the csrf token.
Merge branch 'profile-javascript-error' into login-error-message