What's the best way to skip CSRF for plugin controllers?
In Craft 3 this is a cinch:

class PluginController extends Controller
{
    // Disable CSRF validation for the entire controller 
    public $enableCsrfValidation = false;

    ...


See the Yii2 docs for more control over inividual actions:
https://github.com/yiisoft/yii2/blob/master/docs/guide/security-best-practices.md#avoiding-csrf