add /api/v1/csrf_token for XHR POSTs from browser extensions; fixes #23