look for CSRF token in HTTP headers as well as POST parameters

(re-submitted to different branch)

To make things easier for AJAX requests, it's best to allow the CSRF token to be specified as a custom header. This is the implementation of the feature request in issue #61.