CSRF exemption needs to be on entry handler

It has to be on the first handler that django encounters otherwise it
will boot out POSTs