remove SessionAuthentication to avoid csrf protection
modify wish apiview