Automatically disable CSRF protection for SOAP controllers (fixes #107)