Disable forgery for the API and respond to json only