title: Django 1.6 HTTP_X_CSRFTOKEN header ignored if csrf cookie is missing
body: <p>I have AJAX code which makes POST requests to a Django 1.6.4 application. The view has CSRF protection enabled via the <code>django.middleware.csrf.CsrfViewMiddleware</code>. If I do not pass a cookie but do pass the HTTP_X_CSRFTOKEN, it fails.</p>
  
  <p>I am looking at the code of <code>django.middleware.csrf.CsrfViewMiddleware</code> and I see that on line  161 it checks to see if <code>if csrf_token is None:</code> after getting it from the cookie. If it is None, it returns. Only afterwards does it check the <code>csrfmiddlewaretoken</code> param and the <code>HTTP_X_CSRFTOKEN</code> request header. This looks incorrect and the check for a missing csrf_token value should only be made after checking all the possible places for where it could be found.</p>
  
  <p>Any one else had similar issues? Am I seeing this incorrectly? </p>