Fix the csrf token header to use the experimental prefix, as required by the HTTP standard.