... and I think I've identified the problem. The way I'm saving the parameter, I think some extra characters are coming along for the ride. This appears to work:
web_reg_save_param_ex("paramName=TOKEN", "RB=x-csrf-token: ", "LB=/n", SEARCH_FILTERS, "Scope=Headers", LAST);