no, that was meant as an example for a differently named header field ("x-csrf-token" is the default). should probably make that clearer.