We don't need to add the csrf token to every request, do we? If we do, that needs to be fixed -- that should be done in a template context processor. (I realize this is just copy-pasted code, but this problem still should be dealt with somehow.)