use fetch over $.getJSON

Disco.Web/Areas/API/Controllers/DeviceFlagController.cs

@@ -397,6 +397,7 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
         }
         [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Configure, Claims.Device.Actions.AddFlags, Claims.Device.Actions.RemoveFlags, Claims.Device.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AssignedDevices(int id)
         {
             if (id < 0)

Disco.Web/Areas/API/Controllers/ExpressionsController.cs

@@ -9,14 +9,16 @@ namespace Disco.Web.Areas.API.Controllers
 {
     public partial class ExpressionsController : AuthorizedDatabaseController
     {
-        [HttpPost, DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ValidateExpression(string Expression)
         {
             var part = new EvaluateExpressionPart(Expression);
             return Json(Models.Expressions.ValidateExpressionModel.FromEvaluateExpressionPart(part));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Show), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult TypeDescriptor(string type, bool staticMembersOnly = false)
         {
             if (string.IsNullOrWhiteSpace(type))

Disco.Web/Areas/API/Controllers/SystemController.cs

@@ -308,6 +308,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.Config.System.ConfigureActiveDirectory, Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DomainOrganisationalUnits()
         {
             var domainOUs = ActiveDirectory.RetrieveADOrganisationalUnitStructure()

Disco.Web/Areas/API/Controllers/UserFlagController.cs

@@ -402,6 +402,7 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
         }
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Configure, Claims.User.Actions.AddFlags, Claims.User.Actions.RemoveFlags, Claims.User.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AssignedUsers(int id)
         {
             if (id < 0)