title: Sails.js hook for csrf protection showing strange behaviour when calling from a chrome app like Postman
body: <p>I am performing a post via Postman on my restful API written in sails.js. CSRF flag is enabled in the crfs.js config file. The post is performed without valid csrf token but is working which is surprising me.</p>
  
  <p>In this case the req.headers.origin is filled in and the origin looks like chrome-extension://... As the isSameOrigin function is verifying against http(s) this give no matches back so the result is false and no csrf token verification is done.</p>
  
  <p>Could the code </p>
  
  <pre><code>if (sails.config.csrf &amp;&amp; (!req.headers.origin || util.isSameOrigin(req)))
  </code></pre>
  
  <p>be replaced by </p>
  
  <pre><code>if (sails.config.csrf)
  </code></pre>
  
  <p>Next to this I would like to know what is the best thing to do within a single page app with calls to the REST API. Is it necessary to ask for a csrfToken on each single call or can the same csrfToken be used as long as the session is valid. Which one is the best practice ? The tokens requested seem to remain valid as long as the session is valid.</p>
  
  <p>Highly appreciate your feedback.</p>