Application: set and check CSRF in XSRF-TOKEN header