Alter CSRF exemption implementation

### What is the problem / feature ?

The previous implementation of decorating `APIView.dispach` with the
`csrf_exempt` decorator allowed for an easy-to-make mistake where
someone could override the `dispatch` method on a view and inadvertantly
remove the csrf exemption of their api view.

### How did it get fixed / implemented ?

This pull request moves the decoration of the view into the `as_view` logic (which I believe is less likely to be overridden). By doing so, it becomes much more difficult to make the mistake via overrides of the dispatch method.


*Here is a cute baby animal picture for your troubles...*

![emperor-penguin-chick-snow-hill-island-antarctica](https://cloud.githubusercontent.com/assets/824194/3706302/06422ab6-1428-11e4-8cdc-e6ae49f6b945.jpg)

Let's add a comment here noting that we wrap the view inside `@csrf_exempt` inside `as_view`, and that we do so there because it's harder for subclasses to inadvertently remove the csrf exemption.