json: protect against JSON XSRF

Signed-off-by: Sergei Ianovich <ynvich@gmail.com>