fix(api): non-GET methods now have CSRF protection