I found the first part of kenorb's solution worked for me, i.e. getting the crumb, but for the second part, curl did not like that syntax, it said:
curl: (6) Couldn't resolve host 'http:'
So I had to use the following syntax which worked:
curl -H $CRUMB http://localhost:8080//disable -u USER:TOKEN