"message": "X-CSRF-Token request header is missing"
This is not recommend to remove the X-CSRF-Token. Instead you should get the token from  /rest/session/token and add this token in your header with this value.

But if you want to disable it you can write this below line to your settings.php file  $conf['services_csrf_token_check_disabled'] = TRUE;