Need to skip authenticity filter for POSTs