Form: Disable CSRF counter measure only on API requests

refs #9660

library/Icinga/Web/Form.php

@@ -951,8 +951,7 @@ class Form extends Zend_Form
         if (! $this->tokenDisabled) {
             $request = $this->getRequest();
             if (! $request->isXmlHttpRequest()
-                && ($user = $request->getUser()) !== null
+                && $request->getIsApiRequest()
-                && $user->getIsHttpUser()
             ) {
                 return $this;
             }