use a header to track the CSRF token, not the form data