Disable CSRF tokens for API clients

As a compromise, API clients must set their User-Agent to be
`openessence-api-client`.