JSON API sends BYPS method not POST (deny CSRF)