Implement CSRF protection for AJAX requests

[JasonOffutt]

There are a few AJAX requests that will require some basic CSRF protection. Consider building that part manually, since the built in CSRF stuff doesn't support AJAX requests (it queries Request.Form).