Add csrf_exempt and force check on test client