Move testing config to TestConfig object
Require X-Requested-With header in API
Request with X-Requested-With header
Use Flask-SeaSurf for protecting CSRF in API
Require Flask-SeaSurf