Fix csrf and conform api for POST /api/s/<pk>