alright! Do the regular API calls to your application's APIs (that do succeed) have a header like

rid: "anti-csrf"

in them?