I was under the impression that we had to eventually exclude these endpoints from CSRF protection. @divad12 is of the opinion that we should add a `GET` endpoint for getting a CFRF token instead (and I agree). I'll just leave this in for now.