supports submit order (set X-XSRF-TOKEN to the header) as well as session expired