Attempt to avoid CSRF during API call
Outlined API controller spec