This should do it. Don't check CSRF (because the POST is coming from Cloudmailin).