It's annoying to have to remember which applications need to CSRF skip which handlers. It should be built into the Service interface somehow.