include new csrf headers for device/profile management

Fixes #165