Provide CSRF token in response headers (fixes #16)

This would allow login in JavaScript, since it allows us to fetch the CRSF token with a `HEAD` on `/login` before posting the full credentials.