Conditionally set X-CSRF-Token header.
CSRF shouldn't break all the tests.