The whole dispatch method can be removed since django-rest-framework applies `@csrf_exempt` as well: https://github.com/tomchristie/django-rest-framework/blob/07cb436d610b0e9b6e60b84412c8d6552c0c55a0/rest_framework/views.py#L375