Take csrf token from `X-CSRF-Token` header. Suggested by @yappo++