Fixed bug where xsrf-token wasn't set properly server-side