csrf exempt for search filters