Disable CSRF in API controller

Rescue from MassAssignmentSecurity::Error (attr_accessible)
Skip verify_authenticity_token
Remove IDs from attr_accessible in Tabs and Pages
Tab API specs