3 ms·

This is the right solution. CSRF checks make no sense for an API that is accessed by a non-browser clients.