[Fixed]-403 (FORBIDDEN)

You are not doing it correctly. It feels like you are sending the requestHeader twice.(edit: nevermind didn’t see a part of the code was commented)
Based on your code, try something like this :

    function sendPost() {
        var data = $('form').serialize();
        var file = $(document.getElementById('files').files[0]);
        var csrftoken = getCookie("csrftoken");
        $.ajax({
            method: "POST",
            url: '/delling_data_objects/document/',
            data: data,
            beforeSend: function(xhr, settings) {
                if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
                    xhr.setRequestHeader("X-CSRFToken", csrftoken);
                }
            },
            success: function(data) {
                // whatever you want to do
            }
        });
    }


$('#submit').on('click', function() {
    sendPost();
});


var getCookie = function(name) {
    var cookieValue = null;
    if (document.cookie && document.cookie !== "") {
        var cookies = document.cookie.split(";");
        for (var i = 0; i < cookies.length; i++) {
            var cookie = jQuery.trim(cookies[i]);
            // Does this cookie string begin with the name we want?
            if (cookie.substring(0, name.length + 1) == (name + "=")) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
};

var csrfSafeMethod = function (method) {
    // these HTTP methods do not require CSRF protection
    return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
};