Services CSRF Token request security
If you are using the services module and the user login endpoint, when you perform the login trough your app you should receive:


sessid
session_name
token
user


(This can be investigated further checking the source code here.)

To make all subsequent calls keeping alive the session you just opened (i.e. as a registered user), you need to send the cookie session value and the csrf token value. 

For example:

$ curl http://example.com/app/v1/endpoint --header "Content-type: application/json" --header "Accept: application/json" --header "X-CSRF-Token: X-_xz1fu5eSyHeBPqExAPDg4CdZKlHdiW6Lr7SP3N3Y" --header "Cookie: SESS40c98733719ab6b30c22a4545524a6cc=VWcWeGkTF7xgeMyoQwx5CGPHzIhttUUwmcwq_usiimk"


In theory you shouldn't need to make an extra call just to get the CSRF token, because it is already returned in the first response.