As we're using dynamic URLs for the API, we needed to modify the CSRF-exclusion to allow regexp :)