title: Difference between CSRF and X-CSRF-Token
body: <ul>
  <li>What is the difference between use <code>X-CSRF-Token</code> in an HTTP header or <em>token</em>
  in the hidden field?</li>
  <li>When to use the hidden field and when to use the header and why?</li>
  </ul>
  <p>I think that <code>X-CSRF-Token</code> is when I'm using JavaScript / AJAX but I'm not sure.</p>