pub const CSRF_HEADER: &str = "X-Isb-Csrf";
The anti-CSRF header the web UI sends on every state-changing request.