Turn off csrf checking on the POST returns

+ test