A better way is to use a MAC = Message Authentication Code. This is a hash that uses a cryptographic key. There are many kinds of MACs, but a simple and very effective is just to encrypt your input with a block cipher and use the last block as your crumb (a session id is so small you could use the whole cipher text, not just the last block). Now an attacker can’t figure out what your crumb is unless she knows your encryption key (which you’ll keep on the server, not on the page). To minimize replay attacks, change the key frequently.

For more information, see Bruce Schneier’s classic Applied Cryptography (although many MACs were invented after the last edition, including HMAC). A perfectly good block cipher to use would be RC2.

Another solution with Ajax – X-Requested-By: XMLHttpRequest tells you its an XHR call, which means it came from the same domain.
You must never rely on HTTP header fields as security measurement.

httpOnly cookies also not so useful because many attacks don’t rely on attacker seeing cookie.
Plus you can read out httpOnly cookies via XHR

Crumb is specific to the user and could be a cookie value, in the simplest case.
Don’t encourage users to use solutions that can be easily circumvented. Also one single XSS makes ANY token based protection useless on the whole site (domain).