Sending the CSRF token removes some warnings from the server logs.

Some of the API calls require a session to be open. The client currently does not return the session token to the server in it's request headers. This produces distracting warnings in the server logs which impede debugging. You suspect them to be a problem, even if they actually don't cause any.

This change sends the CSRF token back in the appropriate header, which stops these warnings being generated.