Improved protect_from_forgery for the API