Making @api_view imply @csrf_exempt.