Remove the _csrf_token from routes that don't need it

Problem/Motivation

We have some routes that don't need the _csrf_token, like the drupal pages.

Proposed resolution

Remove the _csrf_token from the routes that don't needed.

Remaining tasks

None.

User interface changes

None.

API changes

None.

Data model changes

None.