add django-crossdomainxhr-middleware
change Auth API to POST