add csrf_exempt for annotation create view