Removed null_session from protect_from_forgery so api works