Remove XSRF from Frontend, add a token to the params instead. RE: #1874, RE: #2046