Bug #2984: Add a csrftoken to the upload ajax call