Requests require the custom header X-Requested-By to prevent a type of CSRF

vulnerability.