Fix API for post. Use XSRF token.