Use csrf token for API calls