Removed CSRF protection for API requests.. see note