Added XSRF safety by x-id header