Allow API access without Authenticity Token