Don't check CSRF token in API calls
Use generic params in API