Use a function to get the token

More reliable: the header is not a string but a function, so right before sending the request, Angular will call `getToken` and get the token.

In my case I wanted my page to be cacheable so the token is loaded via the API, so I have this:

    <meta content="authenticity_token" name="csrf-param" />
    <meta content="{{token}}" name="csrf-token" />

Now, if the token is loaded right before the request, Angular will be loaded and the token will be the correct one. Otherwise, the token was just "{{token}}"