set global http header for xsrf