CSRF protection disabled for services