The AJAX API uses the standard REST API v2, but requires CSRF protection enabled whereas CSRF protection explicitly breaks standard usage of the REST API.

It should be straightforward to expose the REST API at a second endpoint (/api/ajax/v2) but with CSRF protection enabled. This might also allow us to constrain which authentication mechanisms can be used for each API, should that become useful.