ClientsController and TokenEndpointController are called from the outside, so CSRF verification prevents them from normal operation. closes #7062