Since you're already using backbone.js why not plug in CSRF protection with Flask-SeaSurf? (http://flask.pocoo.org/extensions/)
If you use this backbone.js change then CSRF is practically invisible: https://github.com/alanhamlett/backbone/commit/91941afe693ae...
Also, if building an api with Flask make sure you use blueprints with a url prefix so your api routes become relative, which means less typing: http://flask.pocoo.org/docs/blueprints/
Since you're already using backbone.js why not plug in CSRF protection with Flask-SeaSurf? (http://flask.pocoo.org/extensions/)
If you use this backbone.js change then CSRF is practically invisible: https://github.com/alanhamlett/backbone/commit/91941afe693ae...
Also, if building an api with Flask make sure you use blueprints with a url prefix so your api routes become relative, which means less typing: http://flask.pocoo.org/docs/blueprints/