XXX temporarily disable CSRF protection in order to enable API access from mandrill