use an ember App property for the csrf token