[Proposal] CsrfFilter if request is ajax read from X-CSRF-Token header

When making single page apps or ajax driven sites, you may be sending the token via X-CSRF-Token header. I think we can make this validation by default, like the one in AuthFilter. What do you think?

Cheers :)