CSRF token should not be sent cross-domain

csrf-magic adds token to Ajax request. It should avoid sending it to domains that does not match page origin.