Deliver CSRF token to the single page app via cookie and remove injected js.