more messing around with csrf stuff. rails changes session on each request and setting custom headers before a cross-domain request causes a 404