feat(csrf): Uses setting for CSRF header name.