angular CSRF token handling, permitted_params and cosmetic changes