[views] Only allow JSON requests on get_entities

Also redefine __select__ as parent classes require a version in the URL.

cubicweb_rqlcontroller/views.py

@@ -227,13 +227,16 @@ class AnonMultipartRqlIOController(BaseRqlIOController):
     require_csrf = False
 
 
-class GetEntitiesRqlIOController(JsonRqlIOController):
+class GetEntitiesRqlIOController(BaseRqlIOController):
     """GetEntitiesRqlIOController allow to get entities attributes
     from a RQL. Only attributes present in the RQL will be sent.
     """
 
     __regid__ = "rqlio_entities"
-    __select__ = match_http_method("POST")
+    __select__ = match_http_method("POST") & match_request_content_type(
+        "application/json", mode="any"
+    )
+    require_csrf = False
 
     def publish(self, rset=None):
         self._cw.ajax_request = True