Disable JSON CSRF protection.

http://flask.pocoo.org/docs/security/#json-security

This protection was breaking redirects/referals from other sites,
including my recent Twitter link :-(

We don't return a top-level array in an our responses, so we're ok.