(feat): Use JWT on XHR to prevent XSRF attacks on Pro Domains

Is this a bug? Make sure to use the Bug template above and be as detailed in your report as possible.