Support for X-CSRFToken header

An alternative way to accept a csrf token is via an HTTP header, which is often preferable because it keeps it separate from the application data being POSTed.

This method is supported in [Django](https://docs.djangoproject.com/en/dev/ref/contrib/csrf/), [Rails](http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/), [SAP NetWeaver](http://help.sap.com/saphelp_gateway20sp03/helpdata/en/e6/cae27d5e8d4996add4067280c8714e/content.htm), and [others](http://stackoverflow.com/search?q=X-CSRFToken).