set X-CSRFToken by default on store headers