Enable CRSF, but use a dummy token
Use a form encoded body for bodyless POST requests