One thing I'm concerned about is that since we're making this CSRF exempt, wouldn't anyone who figures out this URL path can potentially be able to POST whatever data they want to us and mess with users' email data?