Correct api fixtures

[michalmarcinkowski]

Q	A
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Fixed tickets
License	MIT
Doc PR

When ROLE_API is assigned the csrf token is disabled and it causes exception in the backend.

Method "_token" for object "Symfony\Component\Form\FormView" does not exist

Removed csrf token disable from config, it is handled by ResourceController.

Added fixtures to create new user with ROLE_API for api tests.

[pjedrzejewski]

Thanks Mr. Michal! 👍

[stloyd]

For this looks wrong. The cause of that issue was that you have added role ROLE_API to the normal users, IIRC this was never planned to do it that way.

Removal of disable_csrf_role: ROLE_API will probably break (with CSRF error) any stateless call to the API isn't it?

[pjedrzejewski]

@stloyd It won't, because for api requests we disable csrf anyway. We need to look at this to preoperly use this role. The problem was that you can add such role in the backend and it breaks whole backend, because csrf is disabled.