bug 1025334: don't pass on csrf token header