Add CSRF token to JS POST header