Any reason not to just inline the token here?

`req.setRequestHeader('X-CSRF-Token', '<%= _csrf %>');`

We're not using it anywhere else...