Another new csrf_exempt strategy