[works] chat works without csrf token csrf_exempt