Fix: disable CSRF/PRG for POST API calls.