Do not require CSRF token; upstream should handle this soon.  see http://meta.discourse.org/t/api-handling-csrf-authentication-for-post-etc/10657
Use our own Discourse.current_user_provider since the default is not use ActionDispatch::Request.  Without ActionDispatch::Request, the provider can not get api_key from the params.  Hopefully, we can use upstream default when discourse_api gem is fleshed out.  see http://meta.discourse.org/t/amending-current-user-logic-in-discourse/10278 http://meta.discourse.org/t/improving-discourse-api/9276/7
Merge remote-tracking branch 'upstream/master' into sw/allow-api-request
Merge pull request #1 from LessonPlanet/sw/allow-api-request

Allow api requests