No need in CSRF on login/logout API resources