Rails API Mode seems to ignore Rails.application.config.action_controller.allow_forgery_protection

Question

I recently converted an existing Rails 6 application to an API-only application following this guide as well as some helpful information from here.

My frontend applic