Issue #3115308 by andypost, ankithashetty, paulocs, longwave: Remove _access_rest_csrf route requirement