added csrf exempt decorators to api calls as they use api key auth instead of just session based