move set_csrf_header to api sessions controller