skip CSRF for json requests, allow oPro to manage auth