This is a post request right? there should be a CSRF check, so remove @CSRFExemption