title: protecting against CSRF on ajax requests and forms without submit buttons
body: <p>I'm fairly new to web security. I was wondering what would be the correct way to use tokens on ajax requests and forms without submit buttons (ie status updates) to protect agains CSRF. Could someone show me a code sample? I know how to do it properly for forms with a submit button. Also in my ajax folder I have a htaccess with the following:</p>
  
  <pre><code>SetEnvIfNoCase X-Requested-With XMLHttpRequest ajax
  Order Deny,Allow
  Deny from all
  Allow from env=ajax
  </code></pre>
  
  <p>Is that enough security for ajax requests, or should i also implement token security for ajax requests?</p>