How to completely disable authorization in the Jupiter server?

Question

I start the Jupiter server (1.24.0 version) like this:

jupyter server --ServerApp.token="" --ServerApp.password=""

And I send requests to the API without a token:

GET http://localhost:{{JUPYTER_PORT}}/api/sessions

But this request will return 403.

POST http://localhost:{{JUPYTER_PORT}}/api/sessions

{
  "path": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "Untitled.ipynb",
  "type": "notebook",
  "kernel": {
    "name": "python3"
  }
}

Return:

{
    "message": "'_xsrf' argument missing from POST",
    "reason": null
}

Why? I disabled the authorization check.

How can I start a Jupiter server without having to use cookies and tokens?