60aa52b753
To fully enable session deletion over CORS we need support for passing the `X-Requested-With` header so that these requests can pass the `check-xhr` filter. I also allowed the `X-CSRF-Token` to enable the alternative CSRF passing syntax.