title: CSRF token mismatch for ajax post using nodejs express
body: <p>Environment: express 4, jquery, krakenjs, font-awesome</p>
  
  <p>In controllers/products/index.js</p>
  
  <pre><code>module.exports = function (router) {
      router.post('/add',function(req,res){
          // do something
      });
  };
  </code></pre>
  
  <p>In the html file, users click the icon and add the products into the cart</p>
  
  <pre><code>{?products}
      {#products}
          &lt;ul id="{.id}"&gt;
              &lt;li class="add"&gt;&lt;i class="fa fa-plus"&gt;&lt;/i&gt;&lt;/li&gt;
          &lt;/ul&gt;
      {/products}
  {/products}
  </code></pre>
  
  <p>For each product, the following script is to do the ajax post to backend.</p>
  
  <pre><code>$('.add').click(function(e){
         var _id = this.parentElement.id;
         $.ajax({
             url: "/products/add",
             type: 'POST',
             contentType: 'application/json',
             dataType: 'json',
             data: JSON.stringify({
               id: _id
             })
         });
   });
  </code></pre>
  
  <p>The server then responds 500 (Internal Server Error) and states 'Error: CSRF token mismatch'. Do I need to insert the csrf token in ajax post or eliminate the token validation when doing ajax call without a form submission. </p>