csrf_exempt for the ajax call