问X令牌验证在SAPUI5中失败

EN

function onSave()
{
    useroDataModel = newsap.ui.model.odata.ODataModel("proxy/sap/opu/odata/sap/ZUI_GROUP1_CREATE");

    empid = oTF2.getValue();
    empname = oTF1.getValue();
    empaddr = oTF.getValue();
    empdoj = oDP.getValue();

    uilogon();

    useroDataModel.read("/zui_group1_createCollection(im_emp_id='"+empid+"')", null, null, true, fnSuccess, fnError);

    useroDataModel.setHeaders({
         "X-CSRF-Token": "Fetch"  // auth 
    });

    function fnSuccess(data,response)
    {
        //alert(response.headers['x-csrf-token']);
        var header_xcsrf_token = response.headers['x-csrf-token'];
        //alert(header_xcsrf_token);
        var createrequestdata = {
            im_emp_id : empid,
            im_emp_name : empname(),
            im_emp_addr : empaddr(),
            im_emp_doj : empdoj()
        };

        useroDataModel.setHeaders({
             "X-Requested-With": "XMLHttpRequest",                         
             "Content-Type": "application/atom+xml",  
             "DataServiceVersion": "2.0",   
            "Accept": "application/atom+xml,application/atomsvc+xml,application/xml",  
             "X-CSRF-Token": header_xcsrf_token   
        });

        useroDataModel.create("/zui_g2_createCollection", createrequestdata, null, fnS, fnE);

        function fnS(response){
             if(response.ex_status == "Entry Created.")
                 {
                 alert("Created.");
                 }
             else
                {
                 alert("Failed.");
                }
         }
         function fnE(Error){
             alert("error in create"+Error.message);
         }

    }

    function fnError(oError)
    {
        alert("Error in read"+oError.message);
    }
}

function uilogon()
{
    var tok  = "username" + ':' + "password";  
    var hash = btoa(tok);  
    auth = "Basic" + hash; 
//  alert(auth);
    // Save to Local Storage  
//  $.sap.require("jquery.sap.storage");  
//  var UI5Storage = $.sap.storage(jQuery.sap.storage.Type.session);  
//  UI5Storage.remove("Auth");  
//  UI5Storage.put("Auth",auth);  
    useroDataModel.setHeaders({
        //'Accept-Encoding': "gzip",
        "Authorization" : auth});
//  alert("dne");
}