Fix JSON responses when there's a referer

Was being filtered by JSON CSRF protection in rack-protection. However, this isn't necessary in this API, so I've removed it.