Skip CSRF verification in ApiController 

Close #176