title: Add CSRF protection header to wicket ajax call
body: <p>I'm editing a webpage made using Apache Wicket. And we want to add some CSRF protection to the website. Wanting it to be stateless we want to use a double submit pattern.</p>
  
  <p>For forms we will probably end up using a hidden field that will contain the csrf token.</p>
  
  <p>But we also need to add this to some GET request made using an AjaxFallbackLink which also changes some data (I know it shouldn't do it, but I can't change it currently).
  For this we are considering putting the CSRF token in a custom header that is sent with the request, but I haven't seen any way to hook into the javascript method that wicket uses (the wicketAjaxGet seems to only take a precondition function and a channel function). Are there any suggestion on how I could do this?</p>
  
  <p>Or would adding the token to the url be a good option? What would the problems be in this case, compared to setting it in the header, if we're using https transmission.</p>
  
  <p>Or any other ideas about how we could add CSRF protection to these Ajax GET requests?</p>