This addresses a change in behaviour in a PR I have submitted at laravel/laravel#5083. It should not be considered for merging unless that PR is merged and released. This has now been merged.

This PR addresses the X-CSRF-TOKEN header no longer being automatically sent in bootstrap.js.

Because we include an XSRF-TOKEN cookie, Axios has already been automatically sending an X-XSRF-TOKEN header for us on same-origin requests. This makes the X-CSRF-TOKEN header we are sending redundant.

I have tried to keep the changes minimal without making any overly opinionated changes to the structure of the documentation, however, it may be worth considering restructuring csrf.md so that the X-XSRF-TOKEN section becomes the main section for introducing the header-based verification approaches and to also make it clear that X-XSRF-TOKEN must be the encrypted value and X-CSRF-TOKEN must be unencrypted.