It depends on what we decide wrt the openness of the restful api. ensure csrf means that only our own pages can reference the api (no servers, no interesting apps for discovery...)