api: CSRF-exempt taps view.
kegadmin: Allow profile image edits.