Exempt POST from CSRF for now; works on cross-domain now, works regardless to dev server
Update to try using jsonp for sending data