got most of it working now

rowers/templates/document_form.html

@@ -13,6 +13,7 @@
 </script>
 <script>
   $(document).ready(function() {
+  
   $('#id_file').on('change', function(evt) {
   var f = this.files[0];
   var istcx = false;
@@ -101,6 +102,20 @@
     <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
 <script>   
   $(document).ready(function() {
+  var csrftoken = jQuery("[name=csrfmiddlewaretoken]").val();
+  console.log("CSRF token",csrftoken);
+  
+  function csrfSafeMethod(method) {
+  // these HTTP methods do not require CSRF protection
+  return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+  }
+  $.ajaxSetup({
+  beforeSend: function(xhr, settings) {
+  if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
+  xhr.setRequestHeader("X-CSRFToken", csrftoken);
+  }
+  }
+  });
   console.log("Loading dropper");
   jQuery.event.props.push('dataTransfer');
 
@@ -167,8 +182,42 @@
   console.log("you dropped something");
   var files = e.dataTransfer.files;
   console.log(files[0]);
+
+    var f = files[0];
+    var istcx = false;
+    var isgzip = false;
+    var size1 = 10485760;
+    var size2 = 1048576;
+    if ((/\.(tcx|TCX)/i).test(f.name)) {
+    istcx = true;
+    console.log('tcx');
+    if ((/\.(gz|GZ)/i).test(f.name)) {
+    isgzip = true;
+    console.log('gzip');
+    size1 /= 5;
+    size2 /= 5;
+    }
+    }
+    console.log(f);
+    console.log(size1)
+    console.log(size2)
+    if (f.size > size1) {
+    alert("File Size must be smaller than 10 MB");
+    $("#id_file").value = 0;
+    return false;
+    }
+    if (f.size > size2) {
+    $('#id_offline').val('True');
+    $('#id_offline').prop('checked','True');
+    console.log("Set offline to True");
+    $('#extra_message').text('Because of the large size, we recommend to use  background processing. You will receive email when it is done. The extra actions will not be performed.');
+    $('#extra_message').addClass('message');      
+    }
+
+
+
     data.append("file",files[0]);
-  $("#id_file").replaceWith('<div id="id_file">'+files[0].name+'</div>');
+  $("#id_file").replaceWith('<div id="id_file">'+files[0].name+'&nbsp; <a class="remove" href="javascript:void(0);"><b><font color="red">X</font></b></a></div>');
   },
   mouseenter:function(){$("#id_drop-files").css("background-color","#E9E9E4");},
   mouseleave:function(){$("#id_drop-files").css("background-color","#FFFFFF");},
@@ -177,6 +226,9 @@
   $("#id_drop-files").css("background-color","#E9E9E4");},
   dragleave:function(e){ e.preventDefault();},
     });
+    $(document).on("click", "a.remove", function() {
+    $(this).parent().replaceWith('<td><input id="id_file" name="file" type="file" /></td>');
+    });
   })
 </script>
     {% endblock %}

rowers/views.py

@@ -8401,7 +8401,7 @@ def workout_getc2workout_view(request,c2id):
 	    return HttpResponseRedirect(url)
 
 # This is the main view for processing uploaded files
-@csrf_exempt
+#@csrf_exempt
 @login_required()
 def workout_upload_ajax(request,
                         uploadoptions={