need to use csrf_exempt since the form is posted by an external resource