过滤 CSRF 令牌以保护 CSRF 的安全

我按照这篇文章 http://blog.neoxia.com/laravel4-and-angularjs/来设置和过滤CSRF令牌。我能够使其在本地服务器上工作，但是在我实时部署并对其进行测试后，我不断收到"状态代码 418"。知道吗？

下面是我的代码：

路线.php：

// Route to filter CSRF
Route::filter('serviceCSRF',function(){
if (Session::token() != Request::header('csrf_token')) {
    return Response::json([
        'message' => 'Security token doesn''t match, possible CSRF attack.'
    ], 418);
}
});
// Route for authentication
Route::group(['prefix' => 'api/auth', 'after' => 'allowOrigin'], function() {
Route::get('check', [
    'as'=>'check_auth_path',
    'uses'=>'SessionsController@check'
]);
Route::post('login', [
    'as'=>'login_path',
    'uses'=>'SessionsController@login'
]);
Route::get('sentryLogout', [
    'as'=>'logout_path',
    'uses'=>'SessionsController@logout'
]);
});

会话控制器：

class SessionsController extends 'BaseController {
public function __construct() {
    $this->beforeFilter('serviceCSRF');
}
...

应用.js：

var xhReq = new XMLHttpRequest();
xhReq.open("GET", "//" + window.location.hostname + "/api/csrf", false);
xhReq.send(null);
app.constant("CSRF_TOKEN", xhReq.responseText);
app.run(function ($window, $couchPotato, $rootScope, $state, $stateParams, $http, CSRF_TOKEN) {
    app.lazy = $couchPotato;
    $rootScope.$state = $state;
    $rootScope.$stateParams = $stateParams;
    // editableOptions.theme = 'bs3';
    $http.defaults.headers.common['csrf_token'] = CSRF_TOKEN;
    // watch for location path change
    $rootScope.$on("$locationChangeStart",function() {
    ....