Added suggested CSRF option for APIs