[copr] master: The API should not use csrf in the form (0cf3ddd)