Also send CSRF token for requests triggered from links