CSRF token in header support
Fix my tab vs spaces problem
Django uses a different name for the header

Might as well support that too