core: do not hardcode the CSRF token

Do a token pre-fetch on every page.

Instead of hard coding the CSRF token, we send a
POST request to fetch the token and populate the
JS variable.