look for CSRF token in HTTP headers as well as POST parameters