Set the correct headers and bypass CSRF checking