Separating out CSRF middleware from Experiments middleware