update

internal/app/auth.go

@@ -242,9 +242,15 @@ func (s *Server) requireTechnician(next http.HandlerFunc) http.HandlerFunc {
 			http.Redirect(w, r, "/", http.StatusSeeOther)
 			return
 		}
-		if r.Method != http.MethodGet && r.FormValue("csrf_token") != tech.CSRFToken {
-			http.Error(w, "invalid request token", http.StatusForbidden)
-			return
+		if r.Method != http.MethodGet {
+			csrfToken := r.Header.Get("X-CSRF-Token")
+			if csrfToken == "" {
+				csrfToken = r.FormValue("csrf_token")
+			}
+			if csrfToken != tech.CSRFToken {
+				http.Error(w, "invalid request token", http.StatusForbidden)
+				return
+			}
 		}
 		next(w, r)
 	}