Removing CSRF for API