skip CSRF token check since it doesn't make sense coming from external API