Making JSON requests not require authenticity token