exempt some json-post views from csrf protection