Remove protect_from_forgery in ApiController, which is disabled by the following skip_before_action, as well.