Handle forgery attacks with null session in api controller
Authenticate API controllers with token