Use CSRF header on ajax calls, if available

Hello, I just discovered template editor, but was unable to preview and save template edits.

After further inspection, it seems to be that in template_editor.html' all ajax calls don't use the CSRF header provided by Flask-WTF.

The code suggested in their site regarding javascript requests has no effect.

$.ajaxSetup({
    beforeSend: function(xhr, settings) {
        if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
            xhr.setRequestHeader("X-CSRFToken", csrf_token);
        }
    }
});

I hope it can be fixed, thanks for this great tool.

Start in flask_debugtoolbar/templates/panels/template_editor.html around the AJAX calls linked in the issue, then compare them with Flask-WTF's JavaScript request guidance. Done means template preview and save work when CSRF protection is enabled, while requests still behave appropriately when no token is available.