diff --git a/resources/views/admin/airports/script.blade.php b/resources/views/admin/airports/script.blade.php
index 24b2b75e..86eec502 100644
--- a/resources/views/admin/airports/script.blade.php
+++ b/resources/views/admin/airports/script.blade.php
@@ -54,11 +54,11 @@ function setEditable() {
 
 function phpvms_vacentral_airport_lookup(icao, callback) {
 
-    const csrf_token = $('meta[name="csrf-token"]').attr('content');
     const api_key = $('meta[name="api-key"]').attr('content');
+    const csrf_token = $('meta[name="csrf-token"]').attr('content');
 
     $.ajax({
-        url: BASE_URL + '/api/airports/'+ icao + '/lookup',
+        url: '{{url('/api/airports')}}/' + icao + '/lookup',
         method: 'GET',
         headers: {
             'x-api-key': api_key,
@@ -71,8 +71,8 @@ function phpvms_vacentral_airport_lookup(icao, callback) {
 
 $(document).ready(function() {
 
-    const csrf_token = $('meta[name="csrf-token"]').attr('content');
     const api_key = $('meta[name="api-key"]').attr('content');
+    const csrf_token = $('meta[name="csrf-token"]').attr('content');
 
     setEditable();
 
diff --git a/resources/views/admin/app.blade.php b/resources/views/admin/app.blade.php
index 8563369f..6880efbb 100644
--- a/resources/views/admin/app.blade.php
+++ b/resources/views/admin/app.blade.php
@@ -9,6 +9,7 @@
     <meta name="viewport" content="width=device-width" />
 
     {{-- Start of required lines block. DON'T REMOVE THESE LINES! They're required or might break things --}}
+    <meta name="base-url" content="{{ url() }}">
     <meta name="csrf-token" content="{{ csrf_token() }}">
     <meta name="api-key" content="{{ Auth::check() ? Auth::user()->api_key: '' }}">
     {{-- End the required lines block --}}
diff --git a/resources/views/admin/flights/scripts.blade.php b/resources/views/admin/flights/scripts.blade.php
index a9263bb4..36a8b2ed 100644
--- a/resources/views/admin/flights/scripts.blade.php
+++ b/resources/views/admin/flights/scripts.blade.php
@@ -3,8 +3,8 @@
 
 function setEditable() {
 
-    const csrf_token = $('meta[name="csrf-token"]').attr('content');
     const api_key = $('meta[name="api-key"]').attr('content');
+    const csrf_token = $('meta[name="csrf-token"]').attr('content');
 
     $('#flight_fares a').editable({
         type: 'text',
@@ -41,7 +41,7 @@ $(document).ready(function () {
         type: 'text',
         mode: 'inline',
         emptytext: '0',
-        url: '/admin/flights/{{ $flight->id }}/fields',
+        url: '{{ url('/admin/flights/'.$flight->id.'/fields') }}',
         ajaxOptions: {
             type: 'post',
             headers: {
diff --git a/resources/views/admin/pireps/scripts.blade.php b/resources/views/admin/pireps/scripts.blade.php
index ae07dc43..6da39481 100644
--- a/resources/views/admin/pireps/scripts.blade.php
+++ b/resources/views/admin/pireps/scripts.blade.php
@@ -1,13 +1,19 @@
 @section('scripts')
 <script>
 const changeStatus = (values, fn) => {
+
+    const api_key = $('meta[name="api-key"]').attr('content');
+    const token = $('meta[name="csrf-token"]').attr('content');
+
     console.log('Changing PIREP ' + values.pirep_id + ' to state ' + values.new_status);
+
     $.ajax({
-        url: BASE_URL + '/admin/pireps/' + values.pirep_id + '/status',
+        url: '{{url('/admin/pireps')}}/' + values.pirep_id + '/status',
         data: values,
         type: 'POST',
         headers: {
-            'x-api-key': PHPVMS_USER_API_KEY
+            'x-api-key': api_key,
+            'X-CSRF-TOKEN': token,
         },
         success: function (data) {
             fn(data);
@@ -17,6 +23,9 @@ const changeStatus = (values, fn) => {
 
 $(document).ready(() => {
 
+    const api_key = $('meta[name="api-key"]').attr('content');
+    const token = $('meta[name="csrf-token"]').attr('content');
+
     const select_id = "select#aircraft_select";
     const destContainer = $('#fares_container');
 
@@ -28,7 +37,8 @@ $(document).ready(() => {
             url: "{{ url('/admin/pireps/fares') }}?aircraft_id=" + aircraft_id,
             type: 'GET',
             headers: {
-                'x-api-key': '{{ Auth::user()->api_key }}'
+                'x-api-key': api_key,
+                'X-CSRF-TOKEN': token,
             },
             success: (data) => {
                 console.log('returned new fares', data);
@@ -58,10 +68,11 @@ $(document).ready(() => {
         const pirep_id = $(event.currentTarget).attr('data-pirep-id');
 
         $.ajax({
-            url: BASE_URL + '/api/pireps/' + pirep_id + '/finances/recalculate',
+            url: '{{url('/api/pireps')}}/' + pirep_id + '/finances/recalculate',
             type: 'POST',
             headers: {
-                'x-api-key': PHPVMS_USER_API_KEY
+                'x-api-key': api_key,
+                'X-CSRF-TOKEN': token,
             },
             success: (data) => {
                 console.log(data);