fixed bug with not adding X-CSRF header to data post reqests