CSRF not applicable for API