Add csrf protection for ajax requests