added explicit support for csrf verification via AJAX