[API] disable xsrf for cookie GET requests

Also, list API works now.  Only the file isn't downloaded yet.
Status Job ID Name Coverage
  Build
failed #821
build

 
Name Stage Failure
failed
build Build There has been a timeout failure or the job got stuck. Check your timeout limits or try again
No job trace