Pass the CSRF token for Ajax requests in an X-XSRF-TOKEN request header

[TimWolla]

trafficstars

… add this header automatically for same-site requests and pull the value out of the X-XSRF-TOKEN cookie.

Rationale: Passing the CSRF token as an URL parameter is questionable. The described behavior is compatible with common JavaScript frameworks.

Depends on #3593

[TimWolla]

Blocked on #3543. It does not make sense to make functional changes while everything is in-flux.

[TimWolla]

This probably will become easier with increased PSR-7 use. Moving to 5.6.

[TimWolla]

The header will automatically be consumed by the Xsrf middleware that was added in #5059.