title: CSRF token missing when using Play Framework as an API backend for a Chrome extension
body: <p>I have a project where a Play Framework app serves as an API backend for a Chrome extension. Since I don't specify any filters for the Play Framework project, it enables CSRF protection (via CSRFFilter) by default which may or may not be suitable for my situation.</p>
  
  <p>In the Chrome extension, I first make a jQuery AJAX call to sign in so that the Play Framework server sets a user token cookie (which will be used to identify the user in all subsequent API calls):</p>
  
  <pre><code>        $.ajax({
          method: 'POST',
          url: serverUrl + "api/google_sign_in",
          contentType: "application/json; charset=utf-8",
          data: JSON.stringify({ google_id_token: token }),
          success: function (response) {
              onSuccess();
          },
          error: function (req, status, error) {
              onError(error);
          }
      });
  </code></pre>
  
  <p>The call succeeds and the user token is set as a cookie. So far so good. However as soon as I try to make any other API call using a similar jQuery AJAX call, Play Framework complains that a CSRF token is missing, presumably because now there's a cookie set that needs to be protected:</p>
  
  <pre><code>[CSRF] Check failed because no token found in headers for /api/get_status
  </code></pre>
  
  <p>And the call fails. From my very limited understanding of CSRF protection, the server is supposed to include the CSRF token in some generated HTML at some point? But in this case there are just pure API calls that return JSON. Am I expected to explicitly specify the CSRF token in the JSON returned from the server, and then manually include it as a header in following AJAX calls on the Javascript side?</p>
  
  <p>Also, do I need CSRF protection for this type of API backend? Or can I disable it altogether?</p>
  
  <p>Thanks, Nir</p>