Test CSRF with useCsrfFetch

methodsToProtect: ['POST']

routeRules: { '/api/nocsrf': { csurf: false } }