title: Django @csrf_exempt not working in class View
body: <p>I have an application in Django 1.9 that uses SessionMiddleware. I would like to create an API for this application inside the same project, but when doing a POST request it does not work the @csrf_exempt annotation.</p>
  
  <p>I am doing the requests throw Postman and this is what I have so far:</p>
  
  <p><strong>settings.py</strong></p>
  
  <pre><code>MIDDLEWARE_CLASSES = [
      'corsheaders.middleware.CorsMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.cache.UpdateCacheMiddleware',
      'django.middleware.security.SecurityMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'a9.utils.middleware.LocaleMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'a9.core.access.middleware.AccessMiddleware',
      'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
      'django.middleware.cache.FetchFromCacheMiddleware',    
  ]
  
  OAUTH2_PROVIDER = {
      # this is the list of available scopes
      'SCOPES': {'read': 'Read scope', 'write': 'Write scope', 'groups': 'Access to your groups'}
  }
  
  CORS_ORIGIN_ALLOW_ALL = True
  CORS_ALLOW_METHODS = (
      'DELETE',
      'GET',
      'OPTIONS',
      'PATCH',
      'POST',
      'PUT',
  )
  CORS_ALLOW_HEADERS = (
      'accept',
      'accept-encoding',
      'authorization',
      'content-type',
      'dnt',
      'origin',
      'user-agent',
      'x-csrftoken',
      'x-requested-with',
  )
  
  REST_FRAMEWORK = {
      # Use Django's standard `django.contrib.auth` permissions,
      # or allow read-only access for unauthenticated users.
      'DEFAULT_PERMISSION_CLASSES': [
          'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
          #'rest_framework.permissions.IsAuthenticated',
      ],
      'DEFAULT_AUTHENTICATION_CLASSES': (
          'oauth2_provider.ext.rest_framework.OAuth2Authentication',
          #'rest_framework.authentication.TokenAuthentication',
      )
  }
  </code></pre>
  
  <p><strong>urls.py</strong></p>
  
  <pre><code>urlpatterns = [
      url(r'^v1/', include([
          url(r'^', include(router.urls)),
          url(r'^auth/', MyAuthentication.as_view()),
          url(r'^o/', include('oauth2_provider.urls', namespace='oauth2_provider')),
          url(r'^admin/', include(admin.site.urls)),
      ])),
  ]
  </code></pre>
  
  <p><strong>views.py</strong></p>
  
  <pre><code>@method_decorator(csrf_exempt, name='dispatch')
  class MyAuthentication(TemplateView):
  
      def post(self, request, *args, **kwargs):
  
          return HttpResponse('Hello, World!')
  </code></pre>
  
  <p>After this I get always a CSRF verification failed error.</p>
  
  <p>I asked this question in the IRC channel of django-rest-framework but I still have no answer. Please, any advice will be very appreciated.</p>