+1.  The `x-csrf-key` is entirely npm-specific.