title: CSRF token mismatch in post request in 3.6 version
body: <p>I have two different apps of cakephp. One has a version 3.5 and other 3.6.</p>
  
  <p>When i used and built 3.5 app i did not have a problem of <code>CSRF matching in post request.</code> But now as i am using 3.6 it is giving me error of CSRF token. </p>
  
  <p>Although in both app's <code>AppController</code>, CSRF component is disable.</p>
  
  <p><code>//$this-&gt;loadComponent('Csrf');</code></p>
  
  <p>i am using simple post request like this:</p>
  
  <pre><code>$.ajax({
          type: "POST",
          url: "../user/my_action",
          dataType: 'json',
          success: function (data) {
              set_data(data.response);
          }
      });
  </code></pre>
  
  <p>What am i missing? or some configuration i have done wrong?  </p>