New csrf_exempt strategy