Fix EZP-21270: The CSRF token is passed in header in GET request
!squash
- fixed according to review