added the token to the option_types ajax call from product create form, also. these calls were bypassing the Spree.ajax function for some reason.