diff --git a/src/dataloaders/DataLoaderUtil.ts b/src/dataloaders/DataLoaderUtil.ts
index 3710132ed..2448e71e7 100644
--- a/src/dataloaders/DataLoaderUtil.ts
+++ b/src/dataloaders/DataLoaderUtil.ts
@@ -113,13 +113,17 @@ async function loadBinaryData(datasource: string, name: string) {
 }
 //send json args and return json/array buffer response
 export async function getPostData(url: string, args, return_type = "json") {
+    let headers = {
+        "Accept": "application/json,text/plain,*/*",
+        "Content-Type": "application/json"
+    }
+    if (window["CSRF_TOKEN"]) {
+        headers["X-CSRFToken"] = window["CSRF_TOKEN"];
+    }
     const resp = await fetch(url, {
         method: "POST",
         body: JSON.stringify(args),
-        headers: {
-            "Accept": "application/json,text/plain,*/*",
-            "Content-Type": "application/json"
-        }
+        headers,
     });
     if (return_type === "json") {
         return await resp.json();
diff --git a/src/dataloaders/DataLoaders.js b/src/dataloaders/DataLoaders.js
index 12f284820..54cd7c76f 100644
--- a/src/dataloaders/DataLoaders.js
+++ b/src/dataloaders/DataLoaders.js
@@ -107,12 +107,16 @@ function processArrayBuffer(data,columns,size){
 function getArrayBufferDataLoader(url){
 	return async(columns,dataSource,size)=>{
 		//get the data
+		let headers = {
+			"Content-Type": "application/json"
+		}
+		if (window["CSRF_TOKEN"]) {
+			headers["X-CSRFToken"] = window["CSRF_TOKEN"];
+		}
 		const response = await fetch(url,{
 			method:"POST",
 			body:JSON.stringify({columns:columns,data_source:dataSource}),
-			headers: {
-				'Content-Type': 'application/json'
-			}
+			headers,
 		});
 		//the data is any arraybuffer containing each individual 
 		//column's raw data
diff --git a/src/modules/static_index.ts b/src/modules/static_index.ts
index 41c31d4a1..420d394e3 100644
--- a/src/modules/static_index.ts
+++ b/src/modules/static_index.ts
@@ -23,7 +23,7 @@ const isPopout = urlParams.get('popout') === "true";
 const dir = urlParams.get('dir') || (isPopout ? '' : flaskURL);
 const root = dir.endsWith("/") ? dir.substring(0, dir.length-1) : dir;
 //hack to load data from local API
-const staticFolder = !dir.startsWith("/project");
+const staticFolder = !(dir.startsWith("/project") || dir.startsWith("project"));
 
 // set title of page to the data directory
 document.title = !staticFolder ? 'MDV - local project' : `MDV - ${root}`;
@@ -80,5 +80,6 @@ async function loadData() {
             });
         }, 100);
     }
+
     datasources.forEach((ds, i) => extraFeatures(i));
 };
\ No newline at end of file