The check for a request from jquery.iframe-transport has to inspect
the params not the headers. That's because the plugin doesn't set
headers but instead inserts hidden inputs into the posted form.
The frontend actually sends a location param now that we're interested
in when creating a spot. Previously "location" was a field that the user
could use to refine the location of the spot. It was essentially a
reverse geocoding query field (comparable to that of e.g. google maps).
Because we have to location related fields now we had to find a new name
for that field which is even better. It's now called "location_query".