User login to my Web API Service using his user name and password.
Web API Service response auth token to client browser.
Client page use regular expression to validate every user's inputs.
Client send Ajax requests attached auth token to Web API Service.
Web API service use regular expression to validate data which come from every Ajax request.
By using this approach do I still need anti-forgery token to keep in client page as hidden?