Cleans up injecting CSRF_TOKEN

- made use of angulars .constant feature to setup a server side variable
and make it available to angular as an injectable.