Added csrf exempt to allow POST requests.