Don't CSRF protect the submission URL.