Send list of items as a dict with one element because apparently just a JSON array means CSRF can happen.

(but really who gives a shit?)