Drops csrf in favour of auth token.