Support CSRF header.