title: CSRF Token in REST API with authentication
body: <p>I understood the purpose of the <strong>CSRF Token</strong> protection.</p>
  
  <p>However, I think this protection is useless and we should remove it in the case of a <strong>REST API</strong> requiring <strong>an authentication token</strong> in the header for each action.</p>
  
  <p>This way, even if Mallory forges a malicious HTML link to Alice, the attack can not be done. The reason is that:</p>
  
  <p>Alice keeps her authentication information in a header key that Mallory don't know. And unlike a cookie, Alice's browser doesn't submit this authentication token automatically.</p>
  
  <p>So in this context, I would like to have you point of view about the question: can we remove a CSRF token protection from this kind of API design?</p>