Skip crsrfsrsf check for API controller