nl_tokens: Inject CSRF token via query param .
pl_tokens: function injectQuery ( tokenValue , options , param ) { options . <mask> += ~ options . url . indexOf ( '?' ) ? '&' : '?' ; options . url += param + '=' + tokenValue ; }