csrf_settings of js