CSRF disabled when logging in through REST