Extra csrf

My front-end developer has been pulling his hair out trying to get drf auth/csrf working with can.js

I've added a setting that disables the csrf checks...

Apparently it's quite a pain to inject a header with can.js when you change an object (because it's hidden deep in the framework's bowels), which makes token auth and csrf_token passing painful.

Apparently csrf isn't really an issue with any browser released in the last 5 years.  (I'm told - have no personal view on this).