properly set the X-CSRF-Token header if it is present in the <head>

@kurtfunai:  @celsodantas told me about the bug you found.  Great catch!  We actually had an event listener setting the `X-CSRF-Token` header on the XHR before it was sent, but now I realize that's pretty silly.

This PR hopes to address it

cc @nsimmons @tylermercier