send CSRF header from token