CSRF exemption needs to be on entry handler

It has to be on the first handler that django encounters otherwise it
will boot out POSTs
Merge pull request #208 from alphagov/fix-csrf-exemption

CSRF exemption needs to be on entry handler