Fixed a CSRF-exclude bug and a bug in the library. Now the API is fully excluded from... everything