add csrf_exempt to chat view