LPS-43811 Use application/json content type to prevent rendering HTML
LPS-43843 Add CSRF token check to prevent calling the service from outside the portal