csfr exempt decorator on callback