ensure a csrf token exists even on xhr app

This helps with the extension, where no request to /app for the
HTML content type exists.