A user indicated CSRF issues doing PUT/POST commands to the https:///netbox/api endpoint and also noted an inconvenience using https:///mapi/netbox, namely that since 3rd-party libraries always append /api to the URL it makes it hard to use the /mapi/netbox passthrough (which is already doing the /api already).

So two tasks for this:

• investigate the CSRF issues for PUT/POST (CSRF_TRUSTED_ORIGINS will likely need to be set, but we should make sure it works as long as it is set correctly)
• adjust the /mapi/netbox passthrough to either not prepend the /api to the request automatically, or to keep the current behavior in other cases but detect if /api is already on there, then don't append it.