add ability to set CSRF token via header on the request