csrf exempted heatmap_ajax view