Exempt API from CSRF protect (some other might require)