Adds X-XSRF-TOKEN to cors config.