override httpSecyrity config, disable csrf
X-Auth-Token authentication