Fix #16096 missing CSRF token and use post instead get

[daraelmin]

@hregis it's a fix based on your PR #16124 without the part ($url) that blocks the merging.

If you prefer to submit a corrected version of pour PR, I'll close this PR.

[hregis]

@eldy @daraelmin
sorry but, I did various tests and it is necessary to pass the field "url" to "$url" (global variable) so that the value of "url" is retrieved in the "function" to be used in "$ .post($url, ....." !!