removed the csrf exempt wrapper from each api url