Include Mozilla's django-session-csrf app and enable it

This is a bit more secure than the built-in cookie based approach.