Added CSRF protection for AJAX calls

See this document: http://flask-wtf.readthedocs.org/en/latest/csrf.html
Merge branch 'master' of github.com:dacb/viscount