Remove uneeded CSRF tokens checks

Removed _csrf_token: 'TRUE' requirement for privateMessageMembersAutocomplete callback.
Checked also for ajaxCallback, but it significant to keep _csrf_token here, because of CRUD operations related to that callback.

Yeah, makes sense, however I think the manual setting the token option for the url in uneccessary as along as route has that in requirement. But better to keep it separated.

Automatically closed - issue fixed for 2 weeks with no activity.