Do not check OPTIONS requests for CSRF token