send CSRF token in a response header,

update the page's CSRF tokens with the new token
from the response header,
verify csrf token in ajax endpoints,
initialize a session for every endpoint

includes/csrf.php

@@ -0,0 +1,11 @@
+<?php
+
+include_once('includes/functions.php');
+include_once('includes/session.php');
+
+if (csrfValidateRequest() && !CSRFValidate()) {
+  handleInvalidCSRFToken();
+}
+
+ensureCSRFSessionToken();
+header('X-CSRF-Token', $_SESSION['csrf_token']);

includes/session.php

@@ -0,0 +1,5 @@
+<?php
+
+if (session_status() == PHP_SESSION_NONE) {
+  session_start();
+}