diff --git a/app/views/issues/_form.rhtml b/app/views/issues/_form.rhtml
index b447190..32c1821 100644
--- a/app/views/issues/_form.rhtml
+++ b/app/views/issues/_form.rhtml
@@ -28,7 +28,7 @@
 <p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}), :include_blank => true %>
 <%= prompt_to_remote(l(:label_issue_category_new),
                      l(:label_issue_category_new), 'category[name]', 
-                     {:controller => 'projects', :action => 'add_issue_category', :id => @project},
+                     {:controller => 'projects', :action => 'add_issue_category', :id => @project, :authenticity_token => form_authenticity_token},
                      :class => 'small', :tabindex => 199) if authorize_for('projects', 'add_issue_category') %></p>
 <% end %>
 <%= content_tag('p', f.select(:fixed_version_id, 
diff --git a/public/javascripts/application.js b/public/javascripts/application.js
index 3becbeb..635f038 100644
--- a/public/javascripts/application.js
+++ b/public/javascripts/application.js
@@ -69,7 +69,8 @@ function setPredecessorFieldsVisibility() {
 function promptToRemote(text, param, url) {
     value = prompt(text + ':');
     if (value) {
-        new Ajax.Request(url + '?' + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
+    		var sep = (url.indexOf('?') < 0 ? '?' : '&' )
+        new Ajax.Request(url + sep + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
         return false;
     }
 }