[4.5.5] Strangeness with CSRF, sessions, AJAX

Follow-up:

As an interesting side note, even if I mask the added header (my configured CSRF), CI still seems to hit on it, process it, and remove it. Like this:

Code:

X-abcThisIsMyCSRFHeaderxyz

It's nowhere to be seen when I dump all headers. And this is before CSRF processing in CI takes place, or at least that what it looks like. I've checked the outgoing request headers, and it's there.

-joho