Ignore CSRF if request supplies an API key

Fixes #31