Don't always include X-CSRF-Token header (was breaking Shutterbug)
Don't set X-CSRF-Token header in every req (it was breaking Shutterbug)
Merge branch 'staging' into production