Update CSRF token if passed in headers.