[fix] Skipped CSRF protection on API requests (1m)