Don't include csrf token for GET request