Forcing csrf off for the api