Every search request carries an x-csrf-token header duplicating the csrf_token cookie's value — on top of the cookie itself, which rides along automatically. The server rejects the request unless both are present and match.
x-csrf-token
csrf_token