get XSRF-TOKEN from cookies as a fallback

This is helpful, for example, in an extension setting where newer
versions fo angular don't send the X-XSRF-TOKEN header on CORS
requests. In this case, if the request is with credentials, we
can still get it from the cookie.

Should fix login from the extension.