Mark POST_request_promo as exempt from CSRF checks

:eyeglasses: @bsimpson63 @spladug 

See associated PR for csrf_exempt