moved standard http headers
ability to set xsrf token