no longer require CSRF check

this is killing all PUT requests on passport, we no longer need this as this is resolved in > 3.0.4, 2.3.11