Fix request_forgery_protection to work with API requests.

The default settings raise an error if not given a valid
authenticity_token for all HTML and JSON requests.