[bug 1032571] CSRF exempt the API

The api router function I wrote wasn't marked as CSRF exempt. So all API
POSTs were failing, but they shouldn't be.

This fixes that.