title: Disabling CSRF on a specific action CakePHP 3
body: <p>So, I have a table that is auto-generated using <a href="http://datatables.net/" rel="nofollow">DataTables</a>. An action in my CakePHP grabs the data for that table, and formats it into JSON for datatables to use, this is the formatted JSON:</p>
  
  <pre><code>&lt;?php
  $data = array();
  if (!empty($results)) {
      foreach ($results as $result) {
          $data[] = [
            'name' =&gt; $result-&gt;name,
            'cad' =&gt; $this-&gt;Number-&gt;currency($result-&gt;CAD, 'USD'),
            'usd' =&gt; $this-&gt;Number-&gt;currency($result-&gt;USD, 'USD'),
            'edit' =&gt; '&lt;a href="' .
              $this-&gt;Url-&gt;build(['controller' =&gt; 'Portfolios', 'action' =&gt; 'edit', $result-&gt;id]) .
      '"&gt;&lt;i class="fa fa-pencil"&gt;&lt;/i&gt;&lt;/a&gt;',
            'delete' =&gt; '&lt;input type="checkbox" class="delete" value="' . $result-&gt;id . '"&gt;'
          ];
      }
  }
  
  echo json_encode(compact('data'));
  </code></pre>
  
  <p>As you can see, I have a 'delete' option in there that outputs a checkbox with the value of the id of the corresponding element. When that checkbox is checked, a delete button is showing which sends this ajax request:</p>
  
  <pre><code>$('a#delete').on('click', function(e) {
      e.preventDefault();
      var checkedValues = [];
      $('input.delete:checked').each(function() {
          checkedValues.push($(this).val());
      });
      $.ajax({
          url: $(this).attr('href'),
          type: 'POST',
          data: checkedValues
      });
  })
  </code></pre>
  
  <p>This ajax post goes to my controller action delete(). The problem I'm having is that I'm getting an error that states "Invalid Csrf Token". I know why this is happening, I'm submitting a form with Csrf protection on, that has no Csrf token added to it.</p>
  
  <p>I can't figure out how to manually create a Csrf token for this situation (where the input values are generated after the page has loaded). Nor can I figure out how to disable Csrf protection. I read <a href="http://book.cakephp.org/3.0/en/controllers/components/csrf.html#disabling-the-csrf-component-for-specific-actions" rel="nofollow">this</a>, but the code is placed in the beforeFilter function, and as far as I understand it, that means it's run on every action, not just this one, and that's not what I want. Plus, to be completely honest, I would prefer a solution where I don't deactivate security functions.</p>
  
  <p>Is there anyway to disable Csrf for this specific action, or is there a better way to do this?</p>