Set headers in js and go files to X-Csrf-Token

In app.js and gogs.js `X-Csrf-Token` is used, but in `macaron-contrib/csrf` `X-CSRFToken` is used by default.
So I set up both to `X-Csrf-Token`.
This PR fixes bug with `issue` updating through ajax request.