No CSRF complaining when making API calls