Fixes POST/PUT API requests failing with InvalidAuthenticityToken errors due to missing CSRF tokens. CSRF protection is only necessary for cookie-based authentication. For non-cookie-based authentication we can safely disable it. That is, if the user is already passing their login + api_key, then we don't need to additionally verify the request with a CSRF token. ref: https://github.com/r888888888/danbooru/commit/2e407fa47680eb05b91d20440d498b6a204bf307#comments