look for CSRF token in HTTP headers as well as POST parameters

To make things easier for AJAX requests, it's best to allow the CSRF token to be specified as a custom header.  This is the implementation of the feature request in issue #61.