set in config whether to check CSRF or not (default is to check)
Changing REST access to having to explicitly include those classes that
you want to enable REST access for.
fixing logged in authorisation bug