Remove CSRF for json request only