pass CSRF in header for DELETE calls
hook destroy events as well (for collections and models)
split and re-order underscore/backbone patches
use a full redirect when sending back to /login to reset csrf token