Verification submission endpoint (submitSelfServiceVerificationFlow) still requires CSRF cookie for API flows

[aeneasr]

Describe the bug

The following will fail with a 400 CSRF error despite it being an API flow:

      const flow = (
        await ory
          .initializeSelfServiceVerificationForNativeApps()
          .catch(catcher)
      ).data
      await expect(
        (await ory.getSelfServiceVerificationFlow(flow.id).catch(catcher)).data
          .id
      ).toEqual(flow.id)
      expect(flow.type).toEqual('api')
      await expect(
        ory
          .submitSelfServiceVerificationFlow(flow.id, {
            method: 'link',
            email: user.email
          })
          .catch(catcher)
      ).resolves.toBeTruthy()

Expected behavior

No CSRF issue

Environment

• Version: master

[aeneasr]

Note to self: still an issue