Add X-Requested-With header to prevent XSRF