Ok, but what should i return with same user and CSRF protection not enabled... or when CSRF token not valid ? that's not mentionned in jira ticket, and i'm not sure to have correctly understood the right behaviour we want this ressource to have...