Merge pull request #1661 from cookiebody/master

add tests for csrf-protection with http header X-CSRF-TOKEN