fixed the issues with csrf tokens being passed back and forth between requests -- also changed after_filter in application controller because it was executing after the render