title: Why use request headers for CSRF tokens?
body: <p>To send a CSRF token in an AJAX call, some sites recommend sending it in the request header.</p>
  
  <p>I'm wondering why. What would be the advantage over sending it with the POST variables?</p>
  
  <p>Is there a good reason to send something in the header?</p>