it might be easier to make a module that wraps ``$.ajax()`` so that CSRF tokens are always added automatically.