properly set the X-CSRF-Token header if it is present in the <head>

@kurtfunai:  @celsodantas told me about the bug you found.  Great catch!  We actually had an event listener setting the `X-CSRF-Token` header on the XHR before it was sent, but now I realize that's pretty silly.

This PR hopes to address it

cc @nsimmons @tylermercier 
this is what we were doing, exterior to TurboGraft, so we didn't notice the problem in our usage