Without disabling the CSRF check, the request status code is 403, so I think we do still need it.