add protect from forgery in apis controller