Skip csrf verification for api