Exempted the API from CSRF check