code: function() {
      $.ajaxPrefilter(function(options, originalOptions, jqXHR) {
        var csrfToken;
        if ((options.type !== 'OPTIONS') && (!options.crossDomain)) {
          if (!apos.csrfCookieName) {
            csrfToken = 'csrf-fallback';
          } else {
            csrfToken = $.cookie(apos.csrfCookieName);
          }
          jqXHR.setRequestHeader('X-XSRF-TOKEN', csrfToken);
        }
      });
    }
docs: Angular-compatible. Send the csrftoken cookie as the X-CSRFToken header. This works because if we're running via a script tag or iframe, we won't be able to read the cookie.  https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection  We use Angular's cookie name although CSRF is a more common spelling. -Tom