Initial attempt at passing and setting a new CSRF "dynamically"

Doing a POST to /ghost/signout will return the ```X-CSRF-TOKEN``` header  with
the new value. Then the csrf initializer on the client is updated to reflect
this new value.