remove csurf middleware on '/api/