No longer validate all POSTs, only the ones using the API.
Have the controller return JSON instead of an HTML table when getting bans and watchlists.