Difference between CSRF and X-CSRF-Token
<ul>
<li>What is the difference between use <code>X-CSRF-Token</code> in an HTTP header or <em>token</em>
in the hidden field?</li>
<li>When to use the hidden field and when to use the header and why?</li>
</ul>
<p>I think that <code>X-CSRF-Token</code> is when I'm using JavaScript / AJAX but I'm not sure.</p>