tomchristie/django-rest-framework — pull request #633 by ryazwinski (2013-01-30 23:53:27+00:00)
Title: Extra csrf

My front-end developer has been pulling his hair out trying to get drf auth/csrf working with can.js

I've added a setting that disables the csrf checks...

Apparently it's quite a pain to inject a header with can.js when you change an object (because it's hidden deep in the framework's bowels), which makes token auth and csrf_token passing painful.

Apparently csrf isn't really an issue with any browser released in the last 5 years. (I'm told - have no personal view on this).