Is this a typo? Should this be `x-csrf-token`?