csrf_exempt makes sense only for POST request which are not allowed. So you can remove this decorator.