Fix missing CSRF exemption on viewsets

### What is the problem / feature ?

The adjustment to how CSRF exemption was applied to views in https://github.com/tomchristie/django-rest-framework/pull/1706 was not done to the `as_view` method in `rest_framework.viewsets.ViewSetMixin`.

### How did it get fixed / implemented ?

Wrapped the returned view in `csrf_exempt`.

### How can someone test / see it ?

See that the views returned from viewsets are CSRF exempt.

*Here is a cute animal picture for your troubles...*

![squirrel-waterskiing](https://cloud.githubusercontent.com/assets/824194/4323563/75bd5614-3f51-11e4-9eab-8fdd1a4aa32b.png)