CSRF protection should only cover /rest