make name of HTTP_X_CSRFTOKEN configurable

AngularJS uses a different naming convention for the header field which denotes the csrf token (http://docs.angularjs.org/api/ng.$http). If the name of this header field wasn't hardcoded, integration of AngularJS $http requests would be a breeze.