Disable CSRF on JS endpoint