Although the class name can be determined by sniffing around on the stack: (Thread.
By default all non-GET requests are checked for anti-CSRF token.
See config/xitrum.