Setting cookie token every time there is a XHR

Protects against someone getting a valid token and then just spamming
server.