chage csrf setting
comment out api-key setting