        beforeSend: function (xhr) {

            function getCookie(name) {
                var value = "; " + document.cookie;
                var parts = value.split("; " + name + "=");
                if (parts.length === 2) return parts.pop().split(";").shift();
            }

            xhr.setRequestHeader("X-XSRF-TOKEN", getCookie("XSRF-TOKEN"));
        }

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.