index.js

$.ajax('login', {
    success: function (response) {
        var csrf = $('<div/>').append(response).find('input[name="_csrf_token"]').val();

        if (!csrf) {
            throw 'Failed to parse CSRF value';
        }

        $.ajax('login_check', {
            type: "POST",
            data: {
                _username: $('#username').first().val(),
                _password: $('#password').first().val(),
                _csrf_token: csrf
            },
            success: function () {
                $('#login').modal('hide');
            },
            error: function (xhr) {
                var data = $.parseJSON(xhr.responseText);
                $('.login-error').empty().append(data.message);
            }
        });
    }
});