Added settings page + route
Removed @NoCSRFRequired
JS api calls are working. Time to figure out how the backend works