X-csrf-token

Now csrf-token passed only in body params. I add lookup in request headers. For perfomance reason some time post body contains huge raw binary data, and adding csrf-token to body is not possible. In this case csrf token can be sended throught ```X-csrf-token``` request header. Client side example:

```coffeescript
  array = new Uint8Array(contents);

  $.ajax 
    url: '/xhr/save/push'
    type: 'POST'
    data: array
    processData: false
    contentType: 'application/octet-stream'
    beforeSend: (request) ->
      request.setRequestHeader('X-Profile', JSON.stringify(Epicport['profile']))
      request.setRequestHeader('X-csrf-token', $("meta[name='csrf-token']").attr("content"))
    success: (resp) ->
      Epicport.modalMessage("Success", "Game saved on server")
    error: (xhr, state, error) ->
      status = xhr.status || 500
      error  = error || "Unknown error"

      Epicport.modalMessage("Error (" + status+ ")", "(" + status + "): " + error)
```