postmark API hook does not need CSRF protection