code: private static boolean checkForAjax(HttpServletRequest request, HttpServletResponse response)
        throws IOException {
      if (!"XMLHttpRequest".equals(request.getHeader("X-Requested-With"))) {
        log.log(
            Level.SEVERE, "Received unexpected non-XMLHttpRequest command. Possible CSRF attack.");
        response.sendError(HttpServletResponse.SC_FORBIDDEN,
            "Received unexpected non-XMLHttpRequest command.");
        return false;
      }
      return true;
    }
docs: Checks to ensure that the current request was sent via an AJAX request.
  
  If the request was not sent by an AJAX request, returns false, and sets
  the response status code to 403. This protects against CSRF attacks against
  AJAX only handlers.
  
  @return true if the request is a task queue request