Use x-csrf-token header in admin interfaces