Disable request forgery check since API only