XSRF-protection in BSP application with AJAX support

Dear all,

I try to call an BSP via AJAX with activated xsrf-protection. Then I receive a 500 internal server errror. I think it's because the missing security token. My code is:

$.post("set_next_status.htm", { rid: window.xxx.currId, SESSION_TOKEN: oSAPSecu.GetSessionToken() }, function() {              window.xxx.updateTable();            }).fail(function() {              alert("Der Status konnte nicht gändert werden.")            });

How should I insert the XSRF-Token? oSAPSecu.GetSessionToken() returns null.

Thanks!