Turn off csrf checking on the POST returns

And test