Do not require CSRF protection
Add simple create action
Build new object without saving
Add reasonable error message with HTTP code