Explore `X-Atlassian-Token: nocheck` header

[craftamap]

for some actions we get a xsrf token by fetching a page, but maybe proving the said header is enough.