I have vague memories that the order of these decorators is important in regards to csrf_exempt. I think it has to be either the outermost one or the innermost one.

Can we verify that this is the correct ordering?