Fixed unspecified CSRF token header