include new csrf headers for device/profile management