Removd "csrf" cookie. Only sends "XSRF-TOKEN" auto-detected by Angular.