properly set the X-CSRF-Token header if it is present in the <head>