CSRFProtectionFilter uses non-canonical header name

The CSRFProtectionFilter uses the `X-Requested-By` header, which is fine and meets proper CSRF protection criteria. However- the [OWASP cheat sheet](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet), [wikipedia](https://en.wikipedia.org/wiki/List_of_HTTP_header_fields), jquery, other frameworks, all recommend the `X-Requested-With` header instead.

There is no significant difference between one header or another, except that the latter has become the de-facto standard. Jersey2 should probably adopt it to ease use.

Workaround: The CSRF protection filter is easy enough to self-implement.