make csrf header check case-insensitive