nginx CSRF fix, now ngResource works