look for CSRF token in HTTP headers as well as POST parameters
Merge pull request #69 from brianphillips/csrf-token-header

look for CSRF token in HTTP headers as well as POST parameters