Change protect_from_forgery for API to :null_session