django ajax post 403 forbidden

using django 1.4 im getting a 403 error when i try to do a post from my javascript do my django server. my get works fine though the problem is only with the post. also tried @csrf_exempt with no luck

UPDATE: I can Post now that i added {% csrf_token %} , but the post response comes empty, although the GET comes correctly, any ideas?

my django view:

@csrf_protect
def edit_city(request,username):
    conditions = dict()

    #if request.is_ajax():
    if request.method == 'GET':
        conditions = request.method

    elif request.method == 'POST':
        print "TIPO" , request.GET.get('type','')       
        #based on http://stackoverflow.com/a/3634778/977622     
        for filter_key, form_key in (('type',  'type'), ('city', 'city'), ('pois', 'pois'), ('poisdelete', 'poisdelete'), ('kmz', 'kmz'), ('kmzdelete', 'kmzdelete'), ('limits', 'limits'), ('limitsdelete', 'limitsdelete'), ('area_name', 'area_name'), ('action', 'action')):
            value = request.GET.get(form_key, None)
            if value:
                conditions[filter_key] = value
                print filter_key , conditions[filter_key]

        #Test.objects.filter(**conditions)
    city_json = json.dumps(conditions)

    return HttpResponse(city_json, mimetype='application/json')

here is my javascript code :

function getCookie(name) {
    var cookieValue = null;
    if (document.cookie && document.cookie != '') {
        var cookies = document.cookie.split(';');
        for (var i = 0; i < cookies.length; i++) {
            var cookie = jQuery.trim(cookies[i]);
            // Does this cookie string begin with the name we want?
            if (cookie.substring(0, name.length + 1) == (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}
var csrftoken = getCookie('csrftoken');