Support CSRF via X-CSRFToken Header