[remo, james] allowed csrf to hook api endpoint