CSRF Protection - also check the header

Hi - 

I was reading the CSRF guard code.  Would the authors be opposed to also checking for the csrf key/value set in a X header like X-CSRF-Token ??  It's easier in come scenarios [AngularJS] to use the header.

if there is interest I will submit a patch
