facebook/tornado — pull request #512 by karpitsky (2012-05-14 09:42:43+00:00)
Title: Excluding url for xsrf check ( callbaks from external system )

I have on my own site payment options

Payment systems make callback use method post for special links

If I have options xsrf_cookies in settings enabled (settings['xsrf_cookies'] = True), then payment systems get 403 error