POST requests only; screw CSRF for now
API test POST responses up and working