allow multiple csrf headers
dont check ajax from form param
Merge pull request #10 from mchyzer/master

allow multiple csrf headers