The CGI route requires some CSRF protection relaxations for embeded search