Now that CSRF is solved for API requests (#835) it would be good to support API requests to the `.json` extension.