Duplicate rest_options when adding CSRF header