cleanup(server): Whitelist the requests that cannot have CSRF.