Add middleware that explicitly sets the CSRF token in the header instead ofa cookie.

It's like magic!
Merge branch 'hotfix/remove-extra-csrf-call'