skipping CSRF protection when there are no data on request (?)