Just use explicit authentication for API endpoints. Explicit authentication prevents this attack, CSRF and other confused deputy problems.