Suppress CSRF warnings

`protect_from_forgery` adds a `before_filter` called `verify_authenticity_token`. Since the PostbacksController is acting as an API and checks for a valid API key, we can safely skip that before filter. This will also suppress the following warning that is appearing in application logs.

`WARNING: Can't verify CSRF token authenticity`