# No format segment: Redmine treats .json requests as API calls, which skip the session and the
# CSRF check. theme.js sends JSON to this plain path with the X-CSRF-Token header instead.
put 'tonalmine/appearance', to: 'tonalmine_appearance#update', as: 'tonalmine_appearance', format: false