properly set the X-CSRF-Token header if it is present in the <head>
Merge pull request #47 from Shopify/fix-csrf-token-tg-remote

properly set the X-CSRF-Token header if it is present in the <head>