[translate]: CSRF tokens are now unique only per session (less secure, more functional). Protected AJAX with a x-csrf header