changing protect_from_forgery to null_session to make the API work