allow posting to users/session from rest client
-disabled csrf