Adding in CSRF to the api and changing validation error code to be 400.