diff --git a/LICENSE b/LICENSE
index ee8677c..51ba4e6 100644
--- a/LICENSE
+++ b/LICENSE
@@ -263,6 +263,14 @@
   Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
   Copyright (c) "Cowboy" Ben Alman (2010)"
 
+This project includes the software: jQuery hashchange event
+  Available at: http://benalman.com/projects/jquery-hashchange-plugin/
+  Developed by: "Cowboy" Ben Alman (http://benalman.com/)
+  Inclusive of: jquery.ba-bbq*.js
+  Version used: 1.2
+  Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
+  Copyright (c) "Cowboy" Ben Alman (2010)"
+
 This project includes the software: DataTables Table plug-in for jQuery
   Available at: http://www.datatables.net/
   Developed by: SpryMedia Ltd (http://sprymedia.co.uk/)
@@ -273,7 +281,7 @@
 
 This project includes the software: jquery.easy-autocomplete.js
   Available at: https://github.com/pawelczak/EasyAutocomplete
-  Version used: 1.3.1
+  Version used: 1.3.3
   Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
   Copyright (c) Łukasz Pawełczak (2015)
 
diff --git a/src/main/license/files/LICENSE b/src/main/license/files/LICENSE
index ee8677c..51ba4e6 100644
--- a/src/main/license/files/LICENSE
+++ b/src/main/license/files/LICENSE
@@ -263,6 +263,14 @@
   Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
   Copyright (c) "Cowboy" Ben Alman (2010)"
 
+This project includes the software: jQuery hashchange event
+  Available at: http://benalman.com/projects/jquery-hashchange-plugin/
+  Developed by: "Cowboy" Ben Alman (http://benalman.com/)
+  Inclusive of: jquery.ba-bbq*.js
+  Version used: 1.2
+  Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
+  Copyright (c) "Cowboy" Ben Alman (2010)"
+
 This project includes the software: DataTables Table plug-in for jQuery
   Available at: http://www.datatables.net/
   Developed by: SpryMedia Ltd (http://sprymedia.co.uk/)
@@ -273,7 +281,7 @@
 
 This project includes the software: jquery.easy-autocomplete.js
   Available at: https://github.com/pawelczak/EasyAutocomplete
-  Version used: 1.3.1
+  Version used: 1.3.3
   Used under the following license: The MIT License (http://opensource.org/licenses/MIT)
   Copyright (c) Łukasz Pawełczak (2015)
 
diff --git a/src/main/license/source-inclusions.yaml b/src/main/license/source-inclusions.yaml
index 1c3040e..a9fcd00 100644
--- a/src/main/license/source-inclusions.yaml
+++ b/src/main/license/source-inclusions.yaml
@@ -33,6 +33,7 @@
 - id: async.js
 - id: handlebars.js
 - id: jquery.ba-bbq.js
+- id: jquery.ba-bbq.js-hashchange
 - id: moment.js
 - id: ZeroClipboard
 - id: jquery.dataTables
diff --git a/src/main/webapp/assets/js/model/server-extended-status.js b/src/main/webapp/assets/js/model/server-extended-status.js
index aa9e5fa..2bde5ee 100644
--- a/src/main/webapp/assets/js/model/server-extended-status.js
+++ b/src/main/webapp/assets/js/model/server-extended-status.js
@@ -22,6 +22,13 @@
         callbacks: [],
         loaded: false,
         url: "/v1/server/up/extended",
+        sync: function(method, collection, options){
+            options = options || {};
+            options.beforeSend = function (xhr) {
+                xhr.setRequestHeader('X-Csrf-Token-Required-For-Requests', 'write');
+            };
+            return Backbone.Model.prototype.sync.apply(this, arguments);
+        },
         onError: function(thiz,xhr,modelish) {
             log("ServerExtendedStatus: error contacting Brooklyn server");
             log(xhr);
diff --git a/src/main/webapp/assets/js/router.js b/src/main/webapp/assets/js/router.js
index d26bec2..6404285 100644
--- a/src/main/webapp/assets/js/router.js
+++ b/src/main/webapp/assets/js/router.js
@@ -254,7 +254,7 @@
     });
 
     /*
-     * Prepend a base URL to REST API calls
+     * Prepend a base URL to REST API calls, and add the CSRF token if present.
      */
     $.ajaxSetup({
         beforeSend: function(jqXHR, settings) {
@@ -264,6 +264,17 @@
             if (baseURL && settings.url.startsWith("/v1")) {
                 settings.url = (baseURL + settings.url).replace("//", "/");
             }
+            
+            // add CSRF token as header
+            var ca = document.cookie.split(';');
+            for (var i=0; i<ca.length; i++) {
+                var c = ca[i];
+                while (c.charAt(0)==' ') c = c.substring(1);
+                if (c.toLowerCase().indexOf('csrf-token') != -1) {
+                    var parts = c.split('=');
+                    jqXHR.setRequestHeader('X-'+parts[0], parts[1]);
+                }
+            }
         }
     });