API: Require roles for get_officers.

Enable WTF_CSRF protection.