Share CSRF headers across guest uploads

resources/js/guest/queue/xhr.ts

@@ -1,4 +1,5 @@
 import type { QueueItem } from './queue';
+import { buildCsrfHeaders } from '../lib/csrf';
 
 export async function createUpload(
   url: string,
@@ -9,7 +10,10 @@ export async function createUpload(
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
     xhr.open('POST', url, true);
-    xhr.setRequestHeader('X-Device-Id', deviceId);
+    const headers = buildCsrfHeaders(deviceId);
+    Object.entries(headers).forEach(([key, value]) => {
+      xhr.setRequestHeader(key, value);
+    });
     const form = new FormData();
     form.append('photo', it.blob, it.fileName);
     if (it.emotion_id) form.append('emotion_id', String(it.emotion_id));