added support for the X-CSRF-Token request header