JSON API's Are Automatically Protected Against CSRF, And Google Almost Took It Away. - View it on GitHub