ActivateSubscription is csrf_exempt