We should sanity check that it's actually possible to make a request with the `RestAPI` that violates CSRF. Isn't the rest api injecting a referrer header?