@risto could you call

protectsFromForgery(with = "ignore")

in your controller to make it ignore the check