Passing `X-CSRFToken` header for authentication