improved api security

should make csrf impossible for the client part of plugins