add @csrf_exempt to views.py