text: var CSRF = {
    token: function () {
      var token = document.querySelector('meta[name="csrf-token"]');
      return token && token.getAttribute('content');
    },
    param: function () {
      var param = document.querySelector('meta[name="csrf-param"]');
      return param && param.getAttribute('content');
    }
  };
  
  var sameOrigin = function (url) {
    var a = document.createElement('a'), origin;
    a.href = url;
    origin = a.href.split('/', 3).join('/');
  
    return window.location.href.indexOf(origin) === 0;
  };
  
  window.CSRF = CSRF;
  
  document.addEventListener('ajax:before', function (e) {
    var token = CSRF.token(), xhr = e.detail;
    if (token)
      xhr.setRequestHeader('X-CSRF-Token', token);
  });
  
  document.addEventListener('submit', function (e) {
    var token = CSRF.token(),
        param = CSRF.param(),
        form  = e.target;
  
    if (matches.call(form, 'form')) {
      if (matches.call(form, 'form[data-remote]'))
        return true;
      if (!form.method || form.method.toUpperCase() == 'GET')
        return true;
      if (!sameOrigin(form.action))
        return true;
  
      if (param && token && !form.querySelector('input[name='+param+']')) {
        var input = document.createElement('input');
        input.setAttribute('type', 'hidden');
        input.setAttribute('name', param);
        input.setAttribute('value', token);
  
        form.appendChild(input);
      }
  
      return true;
    }
  });
  