Expose CSRF token in JS