Skipped verification of authenticity token for JSON requests.
Stored the control points as serialised array in the db.