Don't protect against JSON CSRF