TodaySettingsDropdown was the only settings component that omitted the x-csrf-token header, causing PUT /api/profile/today-settings to return 500 for all session-authenticated users. Adds integration tests for the today-settings endpoint.