actually, GET and HEAD should not have the `X-CSRF-Token` (even if HEAD is not used at the moment in the REST API)